BUG: kernel NULL pointer dereference, address: 000000000000002c - RIP: 0010:alloc_extent_buffer
The following kernel BUG: and kernel crash noticed while running xfstests btfs filesystem testing on qemu-x86_64 with loop back.
Steps to reproduce link provided.
Test details: ---- Tests: xfstests-btrfs btrfs/232 SKIP_INSTALL='true' TEST_DEV='/dev/loop0' SCRATCH_DEV='/dev/loop1' TEST_DIR='/mnt/test' SCRATCH_DIR='/mnt/scratch' FILESYSTEM='btrfs' T_SIZE='5G' S_SIZE='8G'
Reported-by: Linux Kernel Functional Testing lkft@linaro.org
Test log: ------- <12>[ 6457.571628] run fstests btrfs/232 at 2024-05-29 16:31:29
<6>[ 6464.685165] BTRFS: device fsid 50147eec-0761-4d75-8e77-df9c50ac385e devid 1 transid 6 /dev/loop1 (7:1) scanned by mount (152729) <6>[ 6464.715051] BTRFS info (device loop1): first mount of filesystem 50147eec-0761-4d75-8e77-df9c50ac385e <6>[ 6464.719266] BTRFS info (device loop1): using crc32c (crc32c-generic) checksum algorithm <6>[ 6464.724996] BTRFS info (device loop1): using free-space-tree <6>[ 6464.789867] BTRFS info (device loop1): checking UUID tree <6>[ 6499.694309] BTRFS info (device loop1): qgroup scan completed (inconsistency flag cleared) <6>[ 6499.766172] BTRFS info (device loop1): qgroup scan completed (inconsistency flag cleared) <1>[ 6572.421678] BUG: kernel NULL pointer dereference, address: 000000000000002c <1>[ 6572.423036] #PF: supervisor read access in kernel mode <1>[ 6572.423070] #PF: error_code(0x0000) - not-present page <6>[ 6572.423143] PGD 0 P4D 0 <4>[ 6572.424555] Oops: Oops: 0000 [#1] PREEMPT SMP PTI <4>[ 6572.424814] CPU: 0 PID: 152772 Comm: fsstress Not tainted 6.10.0-rc1-next-20240529 #1 <4>[ 6572.424946] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 <4>[ 6572.425062] RIP: 0010:alloc_extent_buffer+0x253/0x820 <4>[ 6572.427387] Code: 00 49 8b 7d 08 4c 89 e9 40 f6 c7 01 0f 85 dc 03 00 00 0f 1f 44 00 00 4c 89 ef 48 8b 07 f6 c4 40 0f 84 f7 00 00 00 48 8b 57 28 <8b> 42 2c 85 c0 0f 84 ac 00 00 00 8d 70 01 f0 0f b1 72 2c 75 ee 48 <4>[ 6572.427577] RSP: 0018:ffffae9403eaf700 EFLAGS: 00000202 <4>[ 6572.427613] RAX: 010000000000412d RBX: ffff9eb00d8c5000 RCX: ffffec4001110700 <4>[ 6572.427663] RDX: 0000000000000000 RSI: ffff9eaf3ad5b918 RDI: ffffec4001110700 <4>[ 6572.427705] RBP: 000000000000dec8 R08: ffff9eaf3ad5b918 R09: 0000000000000001 <4>[ 6572.427730] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9eaf0c92b318 <4>[ 6572.427752] R13: ffffec4001110700 R14: 0000000000000000 R15: ffff9eb00f1f82e8 <4>[ 6572.428675] FS: 00007f6ad5d8f740(0000) GS:ffff9eb07bc00000(0000) knlGS:0000000000000000 <4>[ 6572.428756] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 6572.428772] CR2: 000000000000002c CR3: 00000001013ba000 CR4: 00000000000006f0 <4>[ 6572.428905] Call Trace: <4>[ 6572.430288] <TASK> <4>[ 6572.430561] ? __die+0x1e/0x60 <4>[ 6572.433138] ? page_fault_oops+0x17b/0x4b0 <4>[ 6572.433156] ? search_extable+0x26/0x30 <4>[ 6572.434025] ? alloc_extent_buffer+0x253/0x820 <4>[ 6572.434035] ? search_module_extables+0x14/0x50 <4>[ 6572.435608] ? exc_page_fault+0x6b/0x150 <4>[ 6572.436133] ? asm_exc_page_fault+0x26/0x30 <4>[ 6572.436889] ? alloc_extent_buffer+0x253/0x820 <4>[ 6572.436917] read_tree_block+0x1a/0x80 <4>[ 6572.438475] read_block_for_search+0x211/0x320 <4>[ 6572.439418] btrfs_search_slot+0x2db/0xe20 <4>[ 6572.439905] ? kmem_cache_alloc_noprof+0x1cb/0x240 <4>[ 6572.439928] find_parent_nodes+0xee/0x1f20 <4>[ 6572.441382] btrfs_find_all_roots_safe+0x97/0x170 <4>[ 6572.441397] btrfs_qgroup_trace_extent_post+0x70/0xf0 <4>[ 6572.441881] add_delayed_ref+0x514/0x750 <4>[ 6572.442757] btrfs_free_tree_block+0xcd/0x290 <4>[ 6572.442783] btrfs_force_cow_block+0x329/0x7e0 <4>[ 6572.442800] btrfs_cow_block+0xd7/0x280 <4>[ 6572.442814] btrfs_search_slot+0x523/0xe20 <4>[ 6572.442832] btrfs_insert_empty_items+0x35/0x70 <4>[ 6572.442845] btrfs_insert_orphan_item+0x7a/0xb0 <4>[ 6572.443343] btrfs_orphan_add+0x18/0xa0 <4>[ 6572.443863] btrfs_unlink+0x166/0x180 <4>[ 6572.443887] vfs_unlink+0x10d/0x2a0 <4>[ 6572.444369] do_unlinkat+0x28c/0x310 <4>[ 6572.444390] __x64_sys_unlink+0x3c/0x70 <4>[ 6572.444433] do_syscall_64+0x9e/0x1a0 <4>[ 6572.444924] entry_SYSCALL_64_after_hwframe+0x77/0x7f <4>[ 6572.447843] RIP: 0033:0x7f6ad5e8ba07 <4>[ 6572.448529] Code: f0 ff ff 73 01 c3 48 8b 0d f6 83 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 83 0d 00 f7 d8 64 89 01 48 <4>[ 6572.448541] RSP: 002b:00007ffd8a455818 EFLAGS: 00000202 ORIG_RAX: 0000000000000057 <4>[ 6572.448693] RAX: ffffffffffffffda RBX: 00000000000003ae RCX: 00007f6ad5e8ba07 <4>[ 6572.448723] RDX: 0000000000353166 RSI: 0000000000000000 RDI: 0000558cb0972bf0 <4>[ 6572.448735] RBP: 00007ffd8a455970 R08: 00007f6ad5f64c60 R09: 00007ffd8a45595c <4>[ 6572.448744] R10: 00007ffd8a455586 R11: 0000000000000202 R12: 0000558c873925c0 <4>[ 6572.448750] R13: 028f5c28f5c28f5c R14: 8f5c28f5c28f5c29 R15: 0000558c87388cc0 <4>[ 6572.448797] </TASK> <4>[ 6572.448863] Modules linked in: <4>[ 6572.449908] CR2: 000000000000002c <4>[ 6572.450833] ---[ end trace 0000000000000000 ]--- <4>[ 6572.485615] RIP: 0010:alloc_extent_buffer+0x253/0x820 <4>[ 6572.488121] Code: 00 49 8b 7d 08 4c 89 e9 40 f6 c7 01 0f 85 dc 03 00 00 0f 1f 44 00 00 4c 89 ef 48 8b 7 f6 c4 40 0f 84 f7 00 00 00 48 8b 57 28 <8b> 42 2c 85 c0 0f 84 ac 00 00 00 8d 70 01 f0 0f b1 72 2c 75 ee 48 <4>[ 6572.489657] RSP: 0018:ffffae9403eaf700 EFLAGS: 00000202 <4>[ 6572.490176] RAX: 010000000000412d RBX: ffff9eb00d8c5000 RCX: ffffec4001110700 <4>[ 6572.490823] RDX: 0000000000000000 RSI: ffff9eaf3ad5b918 RDI: ffffec4001110700 <4>[ 6572.491363] RBP: 000000000000dec8 R08: ffff9eaf3ad5b918 R09: 0000000000000001 <4>[ 6572.491951] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9eaf0c92b318 <4>[ 6572.492404] R13: ffffec4001110700 R14: 0000000000000000 R15: ffff9eb00f1f82e8 <4>[ 6572.493249] FS: 00007f6ad5d8f740(0000) GS:ffff9eb07bc00000(0000) knlGS:0000000000000000 <4>[ 6572.493710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 6572.494410] CR2: 000000000000002c CR3: 00000001013ba000 CR4: 00000000000006f0
metadata: ---- git_describe: next-20240529 git_repo: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next git_short_log: 9d99040b1bc8 ("Add linux-next specific files for 20240529")
Steps to reproduce: ------- - https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2h94944uxKl...
Links: ----- - https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20240529/tes... - https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20240529/tes... - https://storage.tuxsuite.com/public/linaro/lkft/builds/2h945RbifdV6peYDNNBeB... - https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2h94944uxKl...
-- Linaro LKFT https://lkft.linaro.org
在 2024/5/30 23:26, Naresh Kamboju 写道:
The following kernel BUG: and kernel crash noticed while running xfstests btfs filesystem testing on qemu-x86_64 with loop back.
Steps to reproduce link provided.
Test details:
Tests: xfstests-btrfs btrfs/232 SKIP_INSTALL='true' TEST_DEV='/dev/loop0' SCRATCH_DEV='/dev/loop1' TEST_DIR='/mnt/test' SCRATCH_DIR='/mnt/scratch' FILESYSTEM='btrfs' T_SIZE='5G' S_SIZE='8G'
That's a pretty common setup, and unable to reproduce it here.
Reported-by: Linux Kernel Functional Testing lkft@linaro.org
Test log:
<12>[ 6457.571628] run fstests btrfs/232 at 2024-05-29 16:31:29
<6>[ 6464.685165] BTRFS: device fsid 50147eec-0761-4d75-8e77-df9c50ac385e devid 1 transid 6 /dev/loop1 (7:1) scanned by mount (152729) <6>[ 6464.715051] BTRFS info (device loop1): first mount of filesystem 50147eec-0761-4d75-8e77-df9c50ac385e <6>[ 6464.719266] BTRFS info (device loop1): using crc32c (crc32c-generic) checksum algorithm <6>[ 6464.724996] BTRFS info (device loop1): using free-space-tree <6>[ 6464.789867] BTRFS info (device loop1): checking UUID tree <6>[ 6499.694309] BTRFS info (device loop1): qgroup scan completed (inconsistency flag cleared) <6>[ 6499.766172] BTRFS info (device loop1): qgroup scan completed (inconsistency flag cleared) <1>[ 6572.421678] BUG: kernel NULL pointer dereference, address: 000000000000002c <1>[ 6572.423036] #PF: supervisor read access in kernel mode <1>[ 6572.423070] #PF: error_code(0x0000) - not-present page <6>[ 6572.423143] PGD 0 P4D 0 <4>[ 6572.424555] Oops: Oops: 0000 [#1] PREEMPT SMP PTI <4>[ 6572.424814] CPU: 0 PID: 152772 Comm: fsstress Not tainted 6.10.0-rc1-next-20240529 #1 <4>[ 6572.424946] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 <4>[ 6572.425062] RIP: 0010:alloc_extent_buffer+0x253/0x820
Any line number and code context for it?
It may be a clue for the recent bug of various bad page status.
Thanks, Qu
-- Linaro LKFT https://lkft.linaro.org
-
Naresh Kamboju -
Qu Wenruo