NFS/TCP crashes on MIPS/RBTX4927 in v4.20-rcX (bisected)

From: Geert Uytterhoeven <geert@linux-m68k.org>
To: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Atsushi Nemoto <anemo@mba.ocn.ne.jp>,
	"open list:NFS, SUNRPC, AND..." <linux-nfs@vger.kernel.org>,
	linux-mips@vger.kernel.org,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: NFS/TCP crashes on MIPS/RBTX4927 in v4.20-rcX (bisected)
Date: Tue, 4 Dec 2018 14:53:07 +0100	[thread overview]
Message-ID: <CAMuHMdVJr0PwvJg3FeTCy7vxuyY1=S1tPLHO7hPsoZX4wZ+-cQ@mail.gmail.com> (raw)

        Hi Trond,

Recently, I've upgraded my NFS server to Ubuntu 18.04LTS.  Apparently
the NFS server in that release dropped support for NFS over UDP, hence I
appended ",tcp,v3" to all my nfsroot kernel command line parameters.
This works fine on my arm/arm64 development boards, but causes a crash
on RBTX4927:

    VFS: Mounted root (nfs filesystem) on device 0:13.
    devtmpfs: mounted
    Freeing prom memory: 1020k freed
    Freeing unused kernel memory: 208K
    This architecture does not have kernel memory protection.
    Run /sbin/init as init process
    do_page_fault(): sending SIGSEGV to init for invalid read access
from 57e7e414
    epc = 77f9e188 in ld-2.19.so[77f9c000+22000]
    ra  = 77f9d91c in ld-2.19.so[77f9c000+22000]
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

I found similar crashes in a report from 2006, but of course the code
has changed too much to apply the solution proposed there
(https://www.linux-mips.org/archives/linux-mips/2006-09/msg00169.html).

Userland is Debian 8 (the last release supporting "old" MIPS).
My kernel is based on v4.20.0-rc5, but the issue happens with v4.20-rc1,
too.

However, I noticed it works in v4.19! Hence I've bisected this, to commit
277e4ab7d530bf28 ("SUNRPC: Simplify TCP receive code by switching to using
iterators").

Dropping the ",tcp" part from the nfsroot parameter also fixes the issue.

Given RBTX4926 is little endian, just like my arm/arm64 boards, it's probably
not an endianness issue.  Sparse didn't show anything suspicious before/after
the guilty commit.

Do you have a clue?
Thanks!

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds