From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752924AbdJTXbL (ORCPT ); Fri, 20 Oct 2017 19:31:11 -0400 Received: from esa4.hgst.iphmx.com ([216.71.154.42]:6458 "EHLO esa4.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752605AbdJTXbJ (ORCPT ); Fri, 20 Oct 2017 19:31:09 -0400 X-IronPort-AV: E=Sophos;i="5.43,408,1503331200"; d="scan'208";a="58688520" From: Bart Van Assche To: "linux-block@vger.kernel.org" , "dann.frazier@canonical.com" CC: "linux-arm-kernel@lists.infradead.org" , "linux-kernel@vger.kernel.org" Subject: Re: [bug report] regression bisected to "block: Make most scsi_req_init() calls implicit" Thread-Topic: [bug report] regression bisected to "block: Make most scsi_req_init() calls implicit" Thread-Index: AQHTSfZgUnf0fdfQmkefWAffHMETGqLtYwUA Date: Fri, 20 Oct 2017 23:30:55 +0000 Message-ID: <1508542254.3029.24.camel@wdc.com> References: <20171020225420.utvoqmtwit2isalc@xps13.dannf> In-Reply-To: <20171020225420.utvoqmtwit2isalc@xps13.dannf> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Bart.VanAssche@wdc.com; x-originating-ip: [63.163.107.100] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;CY1PR0401MB1536;20:67TEU7GizKS45U+BF4eVndlLzxISAzXDw09GiH8ielThomM7+H8AYIUu+8QzuJm+mec57/itaXBXeLBHQsG2o0rOBwWvBfESIfMeI5hVvbpaSibiHzj4tlHfYFf8CFxEGDvivrWFpIEUZZN2iRwsAeLQxF0aWPLDtzFWxausV5g= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 2b3869a1-f918-4dbf-c775-08d518129c71 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603199);SRVR:CY1PR0401MB1536; x-ms-traffictypediagnostic: CY1PR0401MB1536: wdcipoutbound: EOP-TRUE x-exchange-antispam-report-test: UriScan:; x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(10201501046)(3231020)(100000703101)(100105400095)(93006095)(93001095)(3002001)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123562025)(20161123564025)(20161123555025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY1PR0401MB1536;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY1PR0401MB1536; x-forefront-prvs: 0466CA5A45 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(6009001)(346002)(376002)(199003)(189002)(24454002)(377424004)(68736007)(8936002)(25786009)(45080400002)(110136005)(76176999)(305945005)(7736002)(2906002)(81156014)(54356999)(50986999)(478600001)(8676002)(6512007)(3280700002)(6246003)(99286003)(3660700001)(189998001)(2900100001)(54906003)(53936002)(77096006)(6436002)(101416001)(33646002)(6486002)(66066001)(81166006)(105586002)(6506006)(14454004)(106356001)(5660300001)(36756003)(86362001)(575784001)(2950100002)(97736004)(316002)(6116002)(2501003)(4001150100001)(3846002)(72206003)(103116003)(229853002)(4326008)(102836003);DIR:OUT;SFP:1102;SCL:1;SRVR:CY1PR0401MB1536;H:CY1PR0401MB1536.namprd04.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: MIME-Version: 1.0 X-OriginatorOrg: wdc.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Oct 2017 23:30:55.4567 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0401MB1536 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id v9KNVGTJ013107 On Fri, 2017-10-20 at 16:54 -0600, dann frazier wrote: > hey, > I'm seeing a regression when executing 'dmraid -r -c' in an arm64 > QEMU guest, which I've bisected to the following commit: > > ca18d6f7 "block: Make most scsi_req_init() calls implicit" > > I haven't yet had time to try and debug it yet, but wanted to get > the report out there before the weekend. Here's the crash: > > [ 138.519885] usercopy: kernel memory overwrite attempt detected to (null) () (6 bytes) > [ 138.521562] kernel BUG at mm/usercopy.c:72! > [ 138.522294] Internal error: Oops - BUG: 0 [#1] SMP > [ 138.523105] Modules linked in: nls_utf8 isofs nls_iso8859_1 qemu_fw_cfg ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables > x_tables autofs4 btrfs zstd_decompress zstd_compress xxhash raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 > multipath linear aes_ce_blk aes_ce_cipher crc32_ce crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_net virtio_blk aes_neon_bs aes_neon_blk crypto_simd cryptd > aes_arm64 > [ 138.531307] CPU: 62 PID: 2271 Comm: dmraid Not tainted 4.14.0-rc5+ #20 > [ 138.532512] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 > [ 138.533796] task: ffff8003cba2e900 task.stack: ffff0000110e8000 > [ 138.534887] PC is at __check_object_size+0x114/0x200 > [ 138.535800] LR is at __check_object_size+0x114/0x200 > [ 138.536711] pc : [] lr : [] pstate: 00400145 > [ 138.538073] sp : ffff0000110ebb00 > [ 138.538682] x29: ffff0000110ebb00 x28: 0000000000000000 > [ 138.539658] x27: 0000ffffd88e1110 x26: ffff8003e8d3d800 > [ 138.540633] x25: 000000000802001d x24: ffff8003e1131920 > [ 138.541621] x23: 0000000000000006 x22: 0000000000000006 > [ 138.542596] x21: 0000000000000000 x20: 0000000000000006 > [ 138.543571] x19: 0000000000000000 x18: ffffffffffffffff > [ 138.544548] x17: 0000ffff83380ce0 x16: ffff0000082dd3b0 > [ 138.545525] x15: ffff0000093c8c08 x14: 6c756e2820202020 > [ 138.546511] x13: 202020202020206f x12: 7420646574636574 > [ 138.547489] x11: ffff0000093c9658 x10: ffff0000086ae800 > [ 138.548466] x9 : 7265766f2079726f x8 : 0000000000000017 > [ 138.549445] x7 : 6c756e3c2820296c x6 : ffff8003eeb51c28 > [ 138.550434] x5 : ffff8003eeb51c28 x4 : 0000000000000000 > [ 138.551411] x3 : ffff8003eeb59ec8 x2 : d4a0cd0f45236000 > [ 138.552388] x1 : 0000000000000000 x0 : 0000000000000059 > [ 138.553364] Process dmraid (pid: 2271, stack limit = 0xffff0000110e8000) > [ 138.554593] Call trace: > [ 138.555043] Exception stack(0xffff0000110eb9c0 to 0xffff0000110ebb00) > [ 138.556214] b9c0: 0000000000000059 0000000000000000 d4a0cd0f45236000 ffff8003eeb59ec8 > [ 138.557653] b9e0: 0000000000000000 ffff8003eeb51c28 ffff8003eeb51c28 6c756e3c2820296c > [ 138.559082] ba00: 0000000000000017 7265766f2079726f ffff0000086ae800 ffff0000093c9658 > [ 138.560510] ba20: 7420646574636574 202020202020206f 6c756e2820202020 ffff0000093c8c08 > [ 138.561950] ba40: ffff0000082dd3b0 0000ffff83380ce0 ffffffffffffffff 0000000000000000 > [ 138.563379] ba60: 0000000000000006 0000000000000000 0000000000000006 0000000000000006 > [ 138.564805] ba80: ffff8003e1131920 000000000802001d ffff8003e8d3d800 0000ffffd88e1110 > [ 138.566238] baa0: 0000000000000000 ffff0000110ebb00 ffff0000082c0e5c ffff0000110ebb00 > [ 138.567666] bac0: ffff0000082c0e5c 0000000000400145 ffff000008e25a80 0000000000000000 > [ 138.569090] bae0: 0001000000000000 0000000000000006 ffff0000110ebb00 ffff0000082c0e5c > [ 138.570523] [] __check_object_size+0x114/0x200 > [ 138.571628] [] sg_io+0x120/0x438 > [ 138.572507] [] scsi_cmd_ioctl+0x594/0x728 > [ 138.573531] [] scsi_cmd_blk_ioctl+0x50/0x60 > [ 138.574594] [] virtblk_ioctl+0x60/0x80 [virtio_blk] > [ 138.575769] [] blkdev_ioctl+0x5e4/0xb50 > [ 138.576756] [] block_ioctl+0x50/0x68 > [ 138.577698] [] do_vfs_ioctl+0xc4/0x940 > [ 138.578671] [] SyS_ioctl+0x8c/0xa8 > [ 138.579581] Exception stack(0xffff0000110ebec0 to 0xffff0000110ec000) > [ 138.580752] bec0: 0000000000000005 0000000000002285 0000ffffd88e10b8 0000000000000006 > [ 138.582199] bee0: 0000000000000000 0000000000000004 0000ffff83416648 0000000000000050 > [ 138.583623] bf00: 000000000000001d 0003ffffffffffff 0000000000000012 0000000000000011 > [ 138.585050] bf20: 0000ffff83409000 00000000000000ff 0000ffff8309dc70 0000000000000531 > [ 138.586490] bf40: 0000ffff8344a360 0000ffff83380ce0 00000000000000dc 0000ffff83478948 > [ 138.587918] bf60: 0000000000000004 0000000017ee7f90 0000000000000005 0000000017ede920 > [ 138.589346] bf80: 0000000017ee7f60 0000000000000003 0000ffff83416648 0000000017ee7f60 > [ 138.590785] bfa0: 0000ffffd88e1218 0000ffffd88e1090 0000ffff834166dc 0000ffffd88e1090 > [ 138.592215] bfc0: 0000ffff83380cec 0000000080000000 0000000000000005 000000000000001d > [ 138.593649] bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 > [ 138.595091] [] el0_svc_naked+0x24/0x28 > [ 138.596071] Code: aa1403e5 aa1303e3 9119a0c0 97f9d96d (d4210000) > [ 138.597193] ---[ end trace b7eecd0b21001177 ]--- > > Here's the ioctl as reported by strace: > > 2277 openat(AT_FDCWD, "/dev/vdb", O_RDONLY) = 5 > 2277 ioctl(5, BLKSSZGET, [512]) = 0 > 2277 ioctl(5, SG_IO, {'S', SG_DXFER_FROM_DEV, cmd[6]=[12, 01, 80, 00, 04, 00], mx_sb_len=0, iovec_count=0, dxfer_len=4, timeout=6000, flags=0 ) = ? > > $ qemu-system-aarch64 -enable-kvm -m 16384 \ > -cpu host -smp 4 -M virt,gic_version=host -nographic \ > -pflash flash0.img -pflash flash1.img \ > -drive if=none,file=artful-server-cloudimg-arm64.img,id=hd0 \ > -device virtio-blk-device,drive=hd0 -drive \ > -if=none,file=my-seed.img,id=hd1 \ > -device virtio-blk-device,drive=hd1 \ > -netdev type=tap,id=net0 -device virtio-net-device,netdev=net0,mac= Hello Dann, Since I do not have access to artful-server-cloudimg-arm64.img, can you convert the crash address into a file name and line number for me (gdb list *(${crash_address})? Can you do this for both __check_object_size+0x114 and sg_io+0x120? Thanks, Bart.