Messages in this thread | | | Date | Thu, 29 Feb 2024 11:09:24 +0100 | From | Christian Brauner <> | Subject | Re: ext4_mballoc_test: Internal error: Oops: map_id_range_down (kernel/user_namespace.c:318) |
| |
On Wed, Feb 28, 2024 at 11:33:36AM -0800, Guenter Roeck wrote: > On 2/28/24 11:26, Daniel Díaz wrote: > > Hello! > > > > On Wed, 28 Feb 2024 at 12:19, Naresh Kamboju <naresh.kamboju@linaro.org> wrote: > > > Kunit ext4_mballoc_test tests found following kernel oops on Linux next. > > > All ways reproducible on all the architectures and steps to reproduce shared > > > in the bottom of this email. > > > > > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > > > > > [ ... ] > > > +Guenter. Just the thing we were talking about, at about the same time. > > > > Good that others see the same problem. Thanks a lot for reporting!
Hm...
static struct super_block *mbt_ext4_alloc_super_block(void) { struct ext4_super_block *es = kzalloc(sizeof(*es), GFP_KERNEL); struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); struct mbt_ext4_super_block *fsb = kzalloc(sizeof(*fsb), GFP_KERNEL);
if (fsb == NULL || sbi == NULL || es == NULL) goto out;
sbi->s_es = es; fsb->sb.s_fs_info = sbi; return &fsb->sb;
out: kfree(fsb); kfree(sbi); kfree(es); return NULL; }
That VFS level struct super_block that is returned from this function is never really initialized afaict? Therefore, sb->s_user_ns == NULL:
i_uid_write(sb, ...) -> NULL = i_user_ns(sb) -> make_kuid(NULL) -> map_id_range_down(NULL)
Outside of this test this can never be the case. See alloc_super() in fs/super.c. So to stop the bleeding this needs something like:
static struct super_block *mbt_ext4_alloc_super_block(void) { struct ext4_super_block *es = kzalloc(sizeof(*es), GFP_KERNEL); struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); struct mbt_ext4_super_block *fsb = kzalloc(sizeof(*fsb), GFP_KERNEL);
if (fsb == NULL || sbi == NULL || es == NULL) goto out;
sbi->s_es = es; fsb->sb.s_fs_info = sbi; + fsb.sb.s_user_ns = &init_user_ns; return &fsb->sb;
out: kfree(fsb); kfree(sbi); kfree(es); return NULL; }
| |