Bug 208437 - kernel NULL pointer dereference on clear_state_bit after resuming from suspend
Summary: kernel NULL pointer dereference on clear_state_bit after resuming from suspend
Status: NEW
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 high
Assignee: BTRFS virtual assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-05 09:54 UTC by Michael
Modified: 2020-07-05 09:58 UTC (History)
1 user (show)

See Also:
Kernel Version: 5.7.6
Subsystem:
Regression: No
Bisected commit-id:


Attachments
dmesg-full (80.17 KB, text/plain)
2020-07-05 09:54 UTC, Michael
Details

Description Michael 2020-07-05 09:54:14 UTC
Created attachment 290095 [details]
dmesg-full

After a while, I noticed some problems with the applications. For example, Firefox was completely hung up and not killed in any way.
After that I noticed that it was impossible to synchronize file systems with btrfs (but data was being written), and I also couldn't shut down my computer (hard reset helped).
This all became apparent after upgrading btrfs-progs to version 5.7.

I am not sure yet, but the problem may have occurred after resuming from suspend.

Steps to Reproduce:
1. Suspend
2. Resume
3. Do something with your files

Actual Results:
Kernel NULL pointer dereference.

Expected Results:
No problems with FS.

System info:
CPU: AMD Phenom(tm) II X4 B40 (Like AMD Athlon X3 440 but with unlocked (stable!) core)
OS: Fedora Workstation 32
btrfs-progs version: 5.7
kernel version: 5.7.6

dmesg:
[ 2372.133220] BUG: kernel NULL pointer dereference, address: 0000000000000011
[ 2372.133225] #PF: supervisor read access in kernel mode
[ 2372.133226] #PF: error_code(0x0000) - not-present page
[ 2372.133227] PGD 12bb93067 P4D 12bb93067 PUD 12bb92067 PMD 0
[ 2372.133231] Oops: 0000 [#1] SMP NOPTI
[ 2372.133235] CPU: 2 PID: 108 Comm: kswapd0 Tainted: P           OE     5.7.6-201.fc32.x86_64 #1
[ 2372.133236] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./960GM-VGS3 FX, BIOS P1.40 07/23/2015
[ 2372.133241] RIP: 0010:rb_next+0x14/0x50
[ 2372.133243] Code: d8 e9 f2 fe ff ff 48 c7 07 01 00 00 00 c3 0f 1f 84 00 00 00 00 00 48 8b 17 48 39 d7 74 35 48 8b 47 08 48 85 c0 74 1c 49 89 c0 <48> 8b 40 10 48 85 c0 75 f4 4c 89 c0 c3 48 3b 78 08 75 f6 48 8b 10
[ 2372.133245] RSP: 0018:ffffb2cf401abaa0 EFLAGS: 00010202
[ 2372.133246] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000001000
[ 2372.133247] RDX: 0000000000000001 RSI: ffff93c17e065460 RDI: ffff93c17e065470
[ 2372.133248] RBP: ffff93c17e065460 R08: 0000000000000001 R09: 0000000000000fff
[ 2372.133249] R10: ffff93c349283000 R11: ffff93c34e1ae300 R12: ffff93c17ea7d888
[ 2372.133250] R13: ffff93c17e065470 R14: 0000000000000000 R15: 0000000000000000
[ 2372.133252] FS:  0000000000000000(0000) GS:ffff93c353c80000(0000) knlGS:0000000000000000
[ 2372.133253] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2372.133254] CR2: 0000000000000011 CR3: 000000012bb90000 CR4: 00000000000006e0
[ 2372.133255] Call Trace:
[ 2372.133305]  clear_state_bit+0x114/0x1a0 [btrfs]
[ 2372.133328]  __clear_extent_bit+0x26a/0x4b0 [btrfs]
[ 2372.133348]  clear_extent_bit+0x15/0x20 [btrfs]
[ 2372.133364]  btrfs_inode_clear_file_extent_range+0x45/0x50 [btrfs]
[ 2372.133383]  btrfs_destroy_inode+0x13b/0x240 [btrfs]
[ 2372.133387]  destroy_inode+0x3b/0x70
[ 2372.133389]  dispose_list+0x48/0x60
[ 2372.133391]  prune_icache_sb+0x44/0x50
[ 2372.133393]  super_cache_scan+0x161/0x1e0
[ 2372.133396]  do_shrink_slab+0x151/0x2c0
[ 2372.133398]  shrink_slab+0x16a/0x270
[ 2372.133400]  shrink_node+0x174/0x680
[ 2372.133402]  balance_pgdat+0x2d5/0x5b0
[ 2372.133405]  kswapd+0x1e8/0x390
[ 2372.133407]  ? finish_wait+0x80/0x80
[ 2372.133408]  ? balance_pgdat+0x5b0/0x5b0
[ 2372.133410]  kthread+0x115/0x140
[ 2372.133411]  ? __kthread_bind_mask+0x60/0x60
[ 2372.133415]  ret_from_fork+0x22/0x40
[ 2372.133417] Modules linked in: snd_seq_dummy snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nft_objref nf_conntrack_tftp tun bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security rfkill ip_set nf_tables nfnetlink ip6table_filter ip6_tables iptable_filter zstd sunrpc nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(OE) edac_mce_amd kvm_amd ccp kvm snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi ledtrig_audio nvidia(POE) snd_hda_intel irqbypass snd_intel_dspcfg snd_hda_codec joydev snd_hda_core wmi_bmof k10temp snd_hwdep pcspkr snd_seq snd_seq_device snd_pcm drm_kms_helper snd_timer ipmi_devintf snd ipmi_msghandler soundcore sp5100_tco i2c_piix4 drm ip_tables serio_raw ata_generic pata_acpi pata_atiixp
[ 2372.133437]  atl1c wmi btrfs blake2b_generic libcrc32c xor raid6_pq fuse
[ 2372.133437] CR2: 0000000000000011
[ 2372.133437] ---[ end trace 9953da078e313b9f ]---
[ 2372.133437] RIP: 0010:rb_next+0x14/0x50
[ 2372.133437] Code: d8 e9 f2 fe ff ff 48 c7 07 01 00 00 00 c3 0f 1f 84 00 00 00 00 00 48 8b 17 48 39 d7 74 35 48 8b 47 08 48 85 c0 74 1c 49 89 c0 <48> 8b 40 10 48 85 c0 75 f4 4c 89 c0 c3 48 3b 78 08 75 f6 48 8b 10
[ 2372.133437] RSP: 0018:ffffb2cf401abaa0 EFLAGS: 00010202
[ 2372.133437] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000001000
[ 2372.133437] RDX: 0000000000000001 RSI: ffff93c17e065460 RDI: ffff93c17e065470
[ 2372.133437] RBP: ffff93c17e065460 R08: 0000000000000001 R09: 0000000000000fff
[ 2372.133437] R10: ffff93c349283000 R11: ffff93c34e1ae300 R12: ffff93c17ea7d888
[ 2372.133437] R13: ffff93c17e065470 R14: 0000000000000000 R15: 0000000000000000
[ 2372.133437] FS:  0000000000000000(0000) GS:ffff93c353c80000(0000) knlGS:0000000000000000
[ 2372.133437] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2372.133437] CR2: 0000000000000011 CR3: 000000012bb90000 CR4: 00000000000006e0

Full dmesg log you can find in attachments.

Note You need to log in before you can comment on or make changes to this bug.