From: ARAI Shun-ichi <hermes@ceres.dti.ne.jp>
To: linux-nilfs@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 in nilfs_segctor_do_construct
Date: Sat, 28 Mar 2020 18:26:40 +0900 (JST) [thread overview]
Message-ID: <20200328.182640.1933740379722138264.hermes@ceres.dti.ne.jp> (raw)
In-Reply-To: <874kuapb2s.fsf@logand.com>
In Msg <874kuapb2s.fsf@logand.com>;
Subject "Re: BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 in nilfs_segctor_do_construct":
> Tomas Hlavaty <tom@logand.com> writes:
>>>> 2) Can you mount the corrupted(?) partition from a recent version of
>>>> kernel ?
>
> I tried the following Linux kernel versions:
>
> - v4.19
> - v5.4
> - v5.5.11
>
> and still get the crash
Ryusuke Konishi pointed out:
In Msg <CAKFNMomjWkNvHvHkEp=Jv_BiGPNj=oLEChyoXX1yCj5xctAkMA@mail.gmail.com>;
Subject "Re: BUG: kernel NULL pointer dereference, address: 00000000000000a8":
> As the result of bisection, it turned out that commit
> f4bdb2697ccc9cecf1a9de86905c309ad901da4c on 5.3.y
> ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages")
> triggers the crash.
This commit modifies __filemap_fdatawrite_range() as follows.
[before]
if (!mapping_cap_writeback_dirty(mapping))
return 0;
[after]
if (!mapping_cap_writeback_dirty(mapping) ||
!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
return 0;
I did simple test with this code (Kernel 5.5.13).
[test]
if (!mapping_cap_writeback_dirty(mapping) ||
mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK))
return 0;
It does not cause crash by the test (without long-term operation). So,
I think that it may be related to PAGECACHE_TAG_TOWRITE.
One possible(?) scenario is:
0. some write operation
1. sync (WB_SYNC_ALL)
2. tagged "PAGECACHE_TAG_TOWRITE"
3. __filemap_fdatawrite_range() is called and returns successfully
(but no-op)
4. some data is/are free-ed
(because of 3.)
5. crash at test/setting writeback for free-ed data
nilfs_segctor_do_construct()
nilfs_segctor_prepare_write()
set_page_writeback()
How about this?
next prev parent reply other threads:[~2020-03-28 9:45 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-17 17:34 BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 in nilfs_segctor_do_construct Tomas Hlavaty
2019-11-18 16:51 ` Ryusuke Konishi
2019-11-19 6:04 ` Viacheslav Dubeyko
2020-01-23 13:00 ` Tomas Hlavaty
2019-12-19 21:02 ` Tomas Hlavaty
2020-01-23 12:31 ` Tomas Hlavaty
2020-03-27 6:26 ` Tomas Hlavaty
[not found] ` <CAKFNMomjWkNvHvHkEp=Jv_BiGPNj=oLEChyoXX1yCj5xctAkMA@mail.gmail.com>
2020-03-28 9:26 ` ARAI Shun-ichi [this message]
2020-04-30 12:38 ` BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 in nilfs_segctor_do_co Hideki EIRAKU
2020-04-30 15:27 ` Tom
2020-05-31 17:49 ` Ryusuke Konishi
[not found] ` <20200601024013.1296-1-hdanton@sina.com>
2020-06-01 11:46 ` Ryusuke Konishi
2020-01-23 13:58 ` BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 in nilfs_segctor_do_construct ARAI Shun-ichi
2020-01-23 14:30 ` ARAI Shun-ichi
2020-02-10 13:46 ` ARAI Shun-ichi
2020-02-16 2:10 ` ARAI Shun-ichi
2020-02-16 2:24 ` Brian G.
2020-02-16 3:59 ` Ryusuke Konishi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200328.182640.1933740379722138264.hermes@ceres.dti.ne.jp \
--to=hermes@ceres.dti.ne.jp \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nilfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).