Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #79933 > unrolled thread

Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal Corey Hickey <bugfood-c@fatooh.org> - 2023-08-05 22:00 +0200
    Bug#1043078: Acknowledgement (linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal) Corey Hickey <bugfood-c@fatooh.org> - 2023-08-06 00:00 +0200
    Processed: Re: Bug#1043078: linux-image-6.3.0-2-amd64: kernel  NULL pointer dereference with MD write-back journal "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-08-06 14:40 +0200
    Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal Salvatore Bonaccorso <carnil@debian.org> - 2023-08-06 14:40 +0200
      Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal Corey Hickey <bugfood-c@fatooh.org> - 2023-08-07 01:50 +0200

#79933 — Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal

[Multipart message — attachments visible in raw view] — view raw

Package: src:linux
Version: 6.3.11-1
Severity: normal

Dear Maintainer,

I was testing RAID-5 write-back journal (AKA cache) for the first time.

https://docs.kernel.org/driver-api/md/raid5-cache.html

I experienced a NULL pointer dereference early in the process.

-------------------- steps leading up to the crash -------------------

Make a RAID-1 from a pair of SSDs.

$ sudo mdadm --create /dev/md101 -l 1 -n 2 /dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H60631*

Make a RAID-5 containing the journal and three block device (one of
which is, in turn a RAID). Size is restricted to 10 GB for testing
purposes.

$ sudo mdadm --create /dev/md5 -n 3 -l 5 -z 10G --write-journal /dev/md101 -c 128K /dev/disk/by-id/ata-TOSHIBA_HDWG21C_* /dev/md3

I waited for the RAID to re-sync (this is necessary in order to enable
write-back jornal mode, though not documented).

Enable write-back mode:

$ echo write-back | sudo tee /sys/block/md5/md/journal_mode

Test writes to the RAID-5 via dd:

$ sudo dd if=/dev/zero of=/dev/md5 iflag=fullblock oflag=direct bs=1M count=10240

------------------------ observed behavior --------------------------
Writes proceded at 100 +/- 4 MB/sec to the journal disks.
Writes proceded at 29 +/- 1 MB/sec to the RAID-5 member devices.
This lasted for 50 +/1 1 second, at which point writes stopped and the
kernel printed an error:
BUG: kernel NULL pointer dereference, address: 0000000000000157


-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.3.0-2-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_DIE, TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-6.3.0-2-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.142
ii  kmod                                    30+20230519-1
ii  linux-base                              4.9

Versions of packages linux-image-6.3.0-2-amd64 recommends:
pn  apparmor             <none>
ii  firmware-linux-free  20200122-1

Versions of packages linux-image-6.3.0-2-amd64 suggests:
pn  debian-kernel-handbook  <none>
ii  grub-efi-amd64          2.06-13
ii  linux-doc-6.3           6.3.11-1

Versions of packages linux-image-6.3.0-2-amd64 is related to:
ii  firmware-amd-graphics     20230515-3
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
pn  firmware-iwlwifi          <none>
pn  firmware-libertas         <none>
pn  firmware-linux-nonfree    <none>
pn  firmware-misc-nonfree     <none>
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information

[toc] | [next] | [standalone]

#79935 — Bug#1043078: Acknowledgement (linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal)

I reproduced this with linux-image-6.4.0-1-amd64 (after a reboot, of
course).

This time, a full write via direct I/O did not trigger the crash, but a 
subsequent write via buffered I/O did result in a crash.

-Corey

[toc] | [prev] | [next] | [standalone]

#79944 — Processed: Re: Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal

Processing control commands:

> tags -1 + moreinfo
Bug #1043078 [src:linux] linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal
Added tag(s) moreinfo.

-- 
1043078: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1043078
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#79946

Control: tags -1 + moreinfo

On Sat, Aug 05, 2023 at 12:45:18PM -0700, Corey Hickey wrote:
> Package: src:linux
> Version: 6.3.11-1
> Severity: normal
> 
> Dear Maintainer,
> 
> I was testing RAID-5 write-back journal (AKA cache) for the first time.
> 
> https://docs.kernel.org/driver-api/md/raid5-cache.html
> 
> I experienced a NULL pointer dereference early in the process.
> 
> -------------------- steps leading up to the crash -------------------
> 
> Make a RAID-1 from a pair of SSDs.
> 
> $ sudo mdadm --create /dev/md101 -l 1 -n 2 /dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H60631*
> 
> Make a RAID-5 containing the journal and three block device (one of
> which is, in turn a RAID). Size is restricted to 10 GB for testing
> purposes.
> 
> $ sudo mdadm --create /dev/md5 -n 3 -l 5 -z 10G --write-journal /dev/md101 -c 128K /dev/disk/by-id/ata-TOSHIBA_HDWG21C_* /dev/md3
> 
> I waited for the RAID to re-sync (this is necessary in order to enable
> write-back jornal mode, though not documented).
> 
> Enable write-back mode:
> 
> $ echo write-back | sudo tee /sys/block/md5/md/journal_mode
> 
> Test writes to the RAID-5 via dd:
> 
> $ sudo dd if=/dev/zero of=/dev/md5 iflag=fullblock oflag=direct bs=1M count=10240
> 
> ------------------------ observed behavior --------------------------
> Writes proceded at 100 +/- 4 MB/sec to the journal disks.
> Writes proceded at 29 +/- 1 MB/sec to the RAID-5 member devices.
> This lasted for 50 +/1 1 second, at which point writes stopped and the
> kernel printed an error:
> BUG: kernel NULL pointer dereference, address: 0000000000000157

If possible can you verify the issue is still present in either the
newest 6.4.y upstream or mainline (or nearest to that, the
6.5~rc4-1~exp1 in experimental)?

If so can you report the issue upstream and link back here the
upstream report?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#79949

On 2023-08-06 05:33, Salvatore Bonaccorso wrote:
> If possible can you verify the issue is still present in either the
> newest 6.4.y upstream or mainline (or nearest to that, the
> 6.5~rc4-1~exp1 in experimental)?
> 
> If so can you report the issue upstream and link back here the
> upstream report?

Yes, I reproduced the bug with 6.4.8 today and reported it to linux-raid.

https://marc.info/?l=linux-raid&m=169136256805891&w=2

Thanks,
Corey

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web