From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f169.google.com (mail-qk1-f169.google.com [209.85.222.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 726C84C77C8 for ; Wed, 8 Jul 2026 18:36:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783535802; cv=none; b=iR3PKmNpMoLCvAldHEJcmP6vZwZmU1G7u7BOyKS7BxpztroQ0gTrj4DI9yDL95ozb9BDRH8UWbjlnY46nk7efuI0uVQ8P/SvhpKjMbge50puJReJjGAxSSTnrStiI4POYZ9uMrX7aoiUlx5TdKWNLCPX5QmNBm/QfeLwZUGBgSQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783535802; c=relaxed/simple; bh=NZHFr2MOLmhMjkgR2/YPepqybQyNYGqfxQtnpDBOW0s=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=NTjkaugB47H5m3HrCWjTYVV0sAQUkwbtk9Bn3kY5lkDYEc0DGUIbdy/Cnu2yTmiuuRE1JkvjiCdlMY7l7KIzc1hylCvOH80GW6xXGD4M/lTdBPLzUa0/jwjT1oMIogzyeCNCmixo8xh8YHcL76kVZZWRzlkM4BqmQkfYK7RkCtE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org; spf=pass smtp.mailfrom=cmpxchg.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b=oFr7D6pn; arc=none smtp.client-ip=209.85.222.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b="oFr7D6pn" Received: by mail-qk1-f169.google.com with SMTP id af79cd13be357-92e4fd65b2bso52547585a.0 for ; Wed, 08 Jul 2026 11:36:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cmpxchg.org; s=google; t=1783535799; x=1784140599; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=HQUQLqO2Mk8JcZRKdWc9LApUtZaqCBfghfuCA1j/MN0=; b=oFr7D6pnMqzMhUsytJSHmF1PRPWgunnSidmEcic8E8ebvfG9XPw5NlWIiYuBUBNlBX DXDjzNNpGrNBTBCeYVXUWc+TFHMw9wtMgxI1fEsAlWERWLcNygyZYskVTypa+6v8OnKt oHZ2m+mL98lUZT7Abq7HkM8nufplLPXUUxHEhEJeHBJT0iqqdCIU/+URPyxGRkOrD4bw dq3fknmjpMpSzwIcSZCpczCfF7y/8/qdL0q7rCS+o+4aB28QhpEJbPf/FuminoJLl1Zk s0hY4beQ9TWXti+j/Yxyh2fKxnmIKrCKfV/Cpjd25aKYNIZC7+8wWBcprr8WfUMh26Ll rHcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783535799; x=1784140599; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HQUQLqO2Mk8JcZRKdWc9LApUtZaqCBfghfuCA1j/MN0=; b=iSQQPfYBxdSRxili+ZkYBSWdED0cTG3cyroMcHsJ47XwcojdoHZ/HabVYIOe2DZw/a 3CZhsg7c1y10N8UB+cNJf0Gbqn6Ku03Nx98xh+Tt4tXwwtz5Jah8oiRYQ28PyS8etW2p SfBYxdFBPVVFfbKyueix8iNbb8yKwJG/ijWflQLVA2d5gFj485tUov25ojdR3eYixgKT TNHh/1IOgxNiQENG8LvyQvVQtPrxPJMVK8+PP2kP5xwJzqbAzqcWBSdXPlT53wLl7uFF hkwFdgpYA1pfq4iu0aDVlFaVKDjHtyDZQRu8McbZq1gHjuluBDidXm/pw3lIK1Z4U2v2 PoXA== X-Forwarded-Encrypted: i=1; AHgh+RpzcLIH59dOO1og4z2buO/r2YZZeQocJWkqE4Pj4l7qFZ6r/U01nML7IK+zwaYlpDuM4uI+4q42YBv2eE4=@vger.kernel.org X-Gm-Message-State: AOJu0YzVoxQ7zDTnslPXxhmlR2gF/P/dXYOhw3kkrFXzvDkAWYALnvTL mK+ycKUfFe2dqVU3lnxYOEkfhZgoMQ0iqQLc95l3u73uXvsX/pvPJl9cJ7JYgmTcV2o= X-Gm-Gg: AfdE7cngaRV8aCmIUD0t2QQZqtp1XZR5nk3hrSQfJXzWxeH93HcU6zHg2N2uwOWYGnZ GwlCggKKXcWZAGO5Yv0rlrMtSI8eayE5k0KVtZjsdYzXjVhxYO1t8EzVIw7azl09Q1aLgmwMl/m FllKPGBqvmIRb2B73Dfx8BfaG7J86ponciYyRgnqxv6wfDUUgb57nfd5UMXasZVPNRT29AR/kLU ZxbWBR0oVLq9o8pulnZ0QWNM5muZI7OgoKsr8rhp5NrbHHVBYTvdlWb93qUlLH58SCFRKWV4pRe OLCxP9D3yRd3zAC9zmmMTDAx6MpoYWePo7y7VDWthfC3B161LRArIXW9ihUP7RpDaER4cQzDuQq F9KXyBt5ABmJ5Ym8Gf8ojhKHs0trn1QgpGmK8dhxx45jXdUOegOOV1wLV3kWLkykI3TZxJsUpun wmRcIQffDTOzA= X-Received: by 2002:a05:620a:4049:b0:90d:c28d:9666 with SMTP id af79cd13be357-92ecf5f5107mr379796585a.30.1783535799119; Wed, 08 Jul 2026 11:36:39 -0700 (PDT) Received: from localhost ([2603:7001:f100:500:365a:60ff:fe62:ff29]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92e90b800fasm1446082185a.6.2026.07.08.11.36.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 11:36:38 -0700 (PDT) Date: Wed, 8 Jul 2026 14:36:31 -0400 From: Johannes Weiner To: Michael Hicklen Cc: linux-ext4@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, tytso@mit.edu, vbabka@suse.cz Subject: Re: kernel NULL pointer dereference in drain_obj_stock during ext4 e4defrag Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Hello Michael, On Tue, Jul 07, 2026 at 06:51:14PM -0500, Michael Hicklen wrote: > Kernel: 7.1.2-arch3-1 > Arch: x86_64 > Hardware: MSI MS-7C95 / PRO B550M-VC WIFI > CPU: AMD (kvm_amd loaded) > > Workload: > > 4 concurrent e4defrag processes operating on 4 separate ext4 > filesystems on 4 separate HDDs. > > The crash happens during memory reclaim while ext4_move_extents() is running. > > First oops: > > BUG: kernel NULL pointer dereference, address: 0000000000000676 > #PF: supervisor read access in kernel mode > > RIP: drain_obj_stock+0x175/0x310 Thanks for the report. The trace and register state suggests that we have the stock pointing to a dead objcg. Through this mess of container_of(), you basically have to read the lines in reverse: drain_obj_stock() mod_objcg_mlstate(old = stock->cached_objcg, stock->cached_pgdat, ...) rcu_read_lock() memcg = obj_cgroup_memcg(old) // objcg->memcg: stale value lruvec = mem_cgroup_lruvec(memcg, pgdat) // memcg->nodeinfo[nid]: stale value mod_memcg_lruvec_state(lruvec, ...) pn = container_of(lruvec, ...) memcg = pn->memcg // freed pn, first 8 bytes now contain 6 pn = memcg->nodeinfo[pgdat->node_id] // <<< faults: 6 + 0x670 = 0x676 Michael, do you have the full dmesg available from this machine? The oops you included already include taint flags for previous crashes and warnings. There is an interleaved Code: block (twice) that disassembles to what looks like an obj_cgroup_get() encountering a percpu_count_ptr of 0, which further suggests use-after-free of the objcg.