Path: csiph.com!news.neodome.net!weretis.net!feeder8.news.weretis.net!srl.newsdeef.eu!news.corradoroberto.it!gothmog.csi.it!bofh.it!news.nic.it!robomod
From: Luca Boccassi <bluca@debian.org>
Newsgroups: linux.debian.bugs.rc
Subject: Bug#1121013: linux: mksquashfs segfaults ~20% of the times with kernel 6.18
Date: Wed, 19 Nov 2025 16:10:01 +0100
Message-ID: <LSRYJ-e9T4-1@gated-at.bofh.it>
X-Mailbox-Line: From debian-bugs-rc-request@lists.debian.org  Wed Nov 19 15:05:12 2025
Old-Return-Path: <debbugs@buxtehude.debian.org>
X-Spam-Flag: NO
X-Spam-Score: -2.6
Reply-To: Luca Boccassi <bluca@debian.org>, 1121013@bugs.debian.org
Resent-To: debian-bugs-dist@lists.debian.org
Resent-Cc: debian-kernel@lists.debian.org
X-Debian-Pr-Message: report 1121013
X-Debian-Pr-Package: src:linux
X-Debian-Pr-Source: linux
X-Gm-Message-State: AOJu0Yx+SfkHyau6rG1FDLEYUWRZBDdpLEbePq6E2Uvg1fo2e+H42u+g 5xxFYEL3mir3HYVMy5IIllInA9KA9wDVHg3dpadIKgQPguh5EuBKFRQkEQxGKqCu
X-Gm-Gg: ASbGncvvMnn+algcOHERXfg9kRwRdlRIjkSHXq7NpBK1vNEjSFVeMXMfzoDjblO7Vns cxZ+saYUmoPi6SQ8TrWsR/9kcQ5SWgNTqQSlGsT3axETUmxmHIDbOtyhxMrmj9yoimr+k3VRWHV 2Gpo98UjG/GrSeZN9yFLOyE2AT+ex1mF5mMVvDt5VgIuy6oqlWZZQNvGkBDzYEeAtPgRyTNhfFi zUZRUQWgCDraG5BoQxcCpuqrCuI//mUMrqcVfnXQXx9lUTsTtOPCzypzVh120nJ4bEHEaoPktVD 0bIZpoTQd2LL9f6TdWlkZwtYc7F/C8POKytlkGRk6MoMd/ytokkTH5VN+YtXS3fybPCUWRVsXyS A++0Hd4D0jtPaUhh+mDgJmBjkQg6CYqUyesWFt8S64q42SPpPVX+mNcxP1WI+Zc1Yrto9VFrGHb ple1chGfIDexdVNZnEDZ3NGvMfSBqb1C4crK+D0Thq3gQAOfD0Z+1LP4W9AQ==
X-Google-SMTP-Source: AGHT+IGcKzdl3mEM+IEmyBUZnNYzOsiBvhi0OyybHx8jleuQfbL94D51EY2j/kLb6DerW8IlmYfTeg==
X-Received: by 2002:a05:690c:490e:b0:786:5789:57c8 with SMTP id 00721157ae682-78929e49ceamr178084637b3.30.1763564644484; Wed, 19 Nov 2025 07:04:04 -0800 (PST)
X-Received: by 2002:a05:690e:1549:10b0:63f:b5dc:4549 with SMTP id 956f58d0204a3-641e7662290mr13845888d50.51.1763564643434; Wed, 19 Nov 2025 07:04:03 -0800 (PST)
MIME-Version: 1.0
X-Gmail-Original-Message-ID: <CAMw=ZnS+-QHD5AgD6PCCUT_eMvozQ07qD0DY7U8GUHej__Q3yQ@mail.gmail.com>
X-Gm-Features: AWmQ_bnocaI90Z7-ak0--gviVsqb_tWHDtU8HgfENm3TT-G3gFReyCmKNoX8IZE
Content-Type: text/plain; charset="UTF-8"
X-Debian-Message: from BTS
X-Mailing-List: <debian-bugs-rc@lists.debian.org> archive/latest/800954
List-ID: <debian-bugs-rc.lists.debian.org>
List-URL: <https://lists.debian.org/debian-bugs-rc/>
Approved: robomod@news.nic.it
Lines: 234
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
X-Original-Date: Wed, 19 Nov 2025 15:03:51 +0000
X-Original-Message-ID: <CAMw=ZnS+-QHD5AgD6PCCUT_eMvozQ07qD0DY7U8GUHej__Q3yQ@mail.gmail.com>
Xref: csiph.com linux.debian.bugs.rc:404889

Source: linux
Version: 6.18~rc6-1~exp1
Severity: serious
Justification: breaks other package's autopkgtest

With kernel 6.18 from experimental mksquashfs segfaults roughly 1 in 4
invocations. This does not happen with the kernel in unstable/testing,
so it looks like a kernel regression.

Filing at serious as it breaks systemd's autopkgtest:
https://ci.debian.net/packages/s/systemd/unstable/amd64/66358275/#S67

Trivial to reproduce:

mkdir -p bar
while mksquashfs bar bar.raw -noappend &>/dev/null; do true; done

Decoded backtrace is strange, it looks like a pointer is corrupted.
Different invocations result in slightly different crashes, although
all seem to be in the xattr code handling, so that looks like a strong
hint as to where things might have regressed.

https://sources.debian.org/src/squashfs-tools/1%3A4.7.4-1/squashfs-tools/xattr.c#L631

#0  0x000055e3c9fddcd9 in read_xattrs (d=d@entry=0x55e3d1388be0,
type=type@entry=1) at ./squashfs-tools/xattr.c:631
        entry = 0x40e33
        dir_ent = <optimized out>
        inode = <optimized out>
        filename = 0x7ffeb945bdbb "bar"
        xattr_list = 0x0
        head = 0x0
        count = 0
        i = <optimized out>
        j = <optimized out>
        l1 = <error reading variable l1 (Cannot access memory at
address 0x40e4b)>
        l2 = <optimized out>
        l3 = <optimized out>
        action_add_list = 0x0
        __func__ = "read_xattrs"
#1  0x000055e3c9fb571f in create_inode
(dir_info=dir_info@entry=0x55e3d1388b70, dir_ent=0x55e3d1388be0,
    type=type@entry=1, byte_size=byte_size@entry=3,
start_block=start_block@entry=0, offset=offset@entry=0,
    block_list=0x0, fragment=0x0, dir_in=0x7ffeb9459840, sparse=0) at
./squashfs-tools/mksquashfs.c:1112
        buf = 0x55e3d1388c30
        inode_header = {base = {inode_type = 0, mode = 0, uid = 0,
guid = 0, mtime = 3599334970,
            inode_number = 32632}, dev = {inode_type = 0, mode = 0,
uid = 0, guid = 0, mtime = 3599334970,
            inode_number = 32632, nlink = 0, rdev = 0}, ldev =
{inode_type = 0, mode = 0, uid = 0, guid = 0,
            mtime = 3599334970, inode_number = 32632, nlink = 0, rdev
= 0, xattr = 24080}, symlink = {
            inode_type = 0, mode = 0, uid = 0, guid = 0, mtime =
3599334970, inode_number = 32632, nlink = 0,
            symlink_size = 0, symlink = 0x7ffeb9459748 "\020^"}, reg =
{inode_type = 0, mode = 0, uid = 0, guid = 0,
            mtime = 3599334970, inode_number = 32632, start_block = 0,
fragment = 0, offset = 24080, file_size = 0,
            block_list = 0x7ffeb9459750}, lreg = {inode_type = 0, mode
= 0, uid = 0, guid = 0, mtime = 3599334970,
            inode_number = 32632, start_block = 0, file_size = 24080,
sparse = 0, nlink = 0, fragment = 0,
            offset = 0, xattr = 0, block_list = 0x7ffeb9459768}, dir =
{inode_type = 0, mode = 0, uid = 0, guid = 0,
            mtime = 3599334970, inode_number = 32632, start_block = 0,
nlink = 0, file_size = 24080, offset = 0,
            parent_inode = 0}, ldir = {inode_type = 0, mode = 0, uid =
0, guid = 0, mtime = 3599334970,
            inode_number = 32632, nlink = 0, file_size = 0,
start_block = 24080, parent_inode = 0, i_count = 0,
            offset = 0, xattr = 0, index = 0x7ffeb9459758}, ipc =
{inode_type = 0, mode = 0, uid = 0, guid = 0,
            mtime = 3599334970, inode_number = 32632, nlink = 0}, lipc
= {inode_type = 0, mode = 0, uid = 0,
            guid = 0, mtime = 3599334970, inode_number = 32632, nlink
= 0, xattr = 0}}
        base = 0x7ffeb9459730
        inode = <optimized out>
        filename = 0x7ffeb945bdbb "bar"
        nlink = 1
        xattr = <optimized out>
        uid = <optimized out>
        gid = <optimized out>
        mode = <optimized out>
#2  0x000055e3c9fb68a0 in write_dir (dir_info=<optimized out>,
dir=0x7ffeb9459840)
    at ./squashfs-tools/mksquashfs.c:1522
        dir_size = <optimized out>
        data_space = <optimized out>
        directory_block = <optimized out>
        directory_offset = <optimized out>
        i_count = 0
        index = 16384
        c_byte = <optimized out>
        cache = <optimized out>
        __func__ = "write_dir"
#3  dir_scan8 (inode=<optimized out>, dir_info=<optimized out>) at
./squashfs-tools/mksquashfs.c:4647
        squashfs_type = <optimized out>
        dir = <optimized out>
        dir_ent = <optimized out>
        file = <optimized out>
#4  0x000055e3c9fbaa85 in do_directory_scans
(dir_ent=dir_ent@entry=0x55e3d1388be0, progress=progress@entry=1)
    at ./squashfs-tools/mksquashfs.c:3620
        inode = 208
        pseudo = <optimized out>
#5  0x000055e3c9fbc041 in scan_single (pathname=0x7ffeb945bdbb "bar",
progress=progress@entry=1)
    at ./squashfs-tools/mksquashfs.c:3675
        buf = {st_dev = 32, st_ino = 21, st_nlink = 2, st_mode =
16877, st_uid = 0, st_gid = 0, __pad0 = 0,
          st_rdev = 0, st_size = 40, st_blksize = 4096, st_blocks = 0,
st_atim = {tv_sec = 1763563405,
            tv_nsec = 364000000}, st_mtim = {tv_sec = 1763562938,
tv_nsec = 96000000}, st_ctim = {
            tv_sec = 1763562938, tv_nsec = 96000000}, __glibc_reserved
= {0, 0, 0}}
        dir_ent = 0x55e3d1388be0
#6  0x000055e3c9fac6b7 in dir_scan (directory=<optimized out>,
progress=1) at ./squashfs-tools/mksquashfs.c:3735
        single = <optimized out>
#7  main (argc=<optimized out>, argv=<optimized out>) at
./squashfs-tools/mksquashfs.c:8769
        buf = {st_dev = 32, st_ino = 22, st_nlink = 1, st_mode =
33188, st_uid = 0, st_gid = 0, __pad0 = 0,
          st_rdev = 0, st_size = 4096, st_blksize = 4096, st_blocks =
8, st_atim = {tv_sec = 1763562951,
            tv_nsec = 448000000}, st_mtim = {tv_sec = 1763563405,
tv_nsec = 360000000}, st_ctim = {
            tv_sec = 1763563405, tv_nsec = 360000000},
__glibc_reserved = {0, 0, 0}}
        source_buf = {st_dev = 32, st_ino = 21, st_nlink = 2, st_mode
= 16877, st_uid = 0, st_gid = 0, __pad0 = 0,
          st_rdev = 0, st_size = 40, st_blksize = 4096, st_blocks = 0,
st_atim = {tv_sec = 1763563405,
            tv_nsec = 360000000}, st_mtim = {tv_sec = 1763562938,
tv_nsec = 96000000}, st_ctim = {
            tv_sec = 1763562938, tv_nsec = 96000000}, __glibc_reserved
= {0, 0, 0}}
        res = 0
        i = <optimized out>
        j = <optimized out>
        root_name = <optimized out>
        inode = <optimized out>
        readq = 496
        fragq = 498
        bwriteq = 496
        fwriteq = <optimized out>
        total_mem = <optimized out>
        progress = 1
        force_progress = <optimized out>
        percentage = <optimized out>
        exclude_option = 0
        Xhelp = <optimized out>
        fragment = 0x0
        command = <optimized out>
        single_threaded = <optimized out>
        overcommit = 0
        repro_opt = <optimized out>
        repro_time_opt = <optimized out>
        repro_time = 4
        __func__ = "main"
(gdb) p l1
Cannot access memory at address 0x40e4b
(gdb) p xattr_add_list
$1 = (struct xattr_add *) 0x0

https://sources.debian.org/src/squashfs-tools/1%3A4.7.4-1/squashfs-tools/xattr.c#L534

#0  0x000055a5314fb9e0 in sort_list (head=head@entry=0x55a531fcfa50
<xattr_add_list>, count=54720)
    at ./squashfs-tools/xattr.c:534
        cur = <optimized out>
        l1 = <optimized out>
        l2 = 0x83500e000000005d
        next = <optimized out>
        len1 = 0
        len2 = <optimized out>
        stride = 1
#1  0x000055a5314fda75 in sort_list (head=0x55a531fcfa50
<xattr_add_list>, count=<optimized out>)
    at ./squashfs-tools/xattr.c:534
        cur = <optimized out>
        l1 = <optimized out>
        l2 = <optimized out>
        next = <optimized out>
        len1 = <optimized out>
        len2 = <optimized out>
        stride = 1
#2  0x000055a5314ca2cf in main (argc=<optimized out>,
argv=0x7fff771b2b58) at ./squashfs-tools/mksquashfs.c:8381
        buf = {st_dev = 60405, st_ino = 4096, st_nlink = 8192, st_mode
= 5, st_uid = 0, st_gid = 61440, __pad0 = 0,
          st_rdev = 69632, st_size = 67156, st_blksize = 67156,
st_blocks = 4096, st_atim = {tv_sec = 61440,
            tv_nsec = 1}, st_mtim = {tv_sec = 69632, tv_nsec = 77824},
st_ctim = {tv_sec = 73736, tv_nsec = 73856},
          __glibc_reserved = {4096, 65536, 3}}
        source_buf = {st_dev = 4, st_ino = 17179869188, st_nlink =
1975252, st_mode = 1975252, st_uid = 0,
          st_gid = 1975252, __pad0 = 0, st_rdev = 32, st_size = 32,
st_blksize = 4, st_blocks = 17179869191,
          st_atim = {tv_sec = 1977176, tv_nsec = 1981272}, st_mtim =
{tv_sec = 1981272, tv_nsec = 16}, st_ctim = {
            tv_sec = 136, tv_nsec = 8}, __glibc_reserved =
{18865251667, 904, 904}}
        res = 0
        i = 4
        j = <optimized out>
        root_name = <optimized out>
        inode = <optimized out>
        readq = 496
        fragq = 498
        bwriteq = 496
        fwriteq = <optimized out>
        total_mem = <optimized out>
        progress = 1
        force_progress = <optimized out>
        percentage = <optimized out>
        exclude_option = 0
        Xhelp = <optimized out>
        fragment = 0x0
        command = <optimized out>
        single_threaded = <optimized out>
        overcommit = 0
        repro_opt = <optimized out>
        repro_time_opt = <optimized out>
        repro_time = 4
        __func__ = "main"