【OLK-6.6】【JFFS2】jffs2文件系统kfree inode时出现oops

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**
jffs2文件系统kfree inode时出现oops
**一、缺陷信息**

~~~
[  142.578595][    C3] BUG: unable to handle page fault for address: fffffe5f5d000008
[  142.580779][    C3] #PF: supervisor read access in kernel mode
[  142.582432][    C3] #PF: error_code(0x0000) - not-present page
[  142.584095][    C3] PGD 43ffc7067 P4D 43ffc7067 PUD 0 
[  142.585564][    C3] Oops: 0000 [#1] PREEMPT SMP PTI
[  142.586967][    C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.6.0+ #48
[  142.588868][    C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[  142.591535][    C3] RIP: 0010:kfree+0x4f/0x120
[  142.593450][    C3] Code: 80 48 01 d8 0f 82 df 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 1b c5 46 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 f9 c4 46 01 <48> 8b 50 08 48 89 c7 f6 c2 01 06
[  142.597604][    C3] RSP: 0018:ffffb97240180ed0 EFLAGS: 00010286
[  142.598905][    C3] RAX: fffffe5f5d000000 RBX: 0000000000000064 RCX: 000000002a930003
[  142.600624][    C3] RDX: 00006f26c0000000 RSI: ffffffffc03c1bd6 RDI: 0000000000000064
[  142.602165][    C3] RBP: ffff90d9c03e6000 R08: 0000000000000000 R09: 0000000000038750
[  142.603363][    C3] R10: ffffffff832060c0 R11: 000000000000510b R12: ffff90dcefcf3d40
[  142.604610][    C3] R13: 0000000000000001 R14: 000000000000000a R15: 0000000000000000
[  142.605921][    C3] FS:  0000000000000000(0000) GS:ffff90dcefcc0000(0000) knlGS:0000000000000000
[  142.607340][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  142.608372][    C3] CR2: fffffe5f5d000008 CR3: 0000000057e1a000 CR4: 00000000000006e0
[  142.609627][    C3] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  142.610855][    C3] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  142.612098][    C3] Call Trace:
[  142.614105][    C3]  <IRQ>
[  142.614449][    C3]  ? __die+0x31/0x90
[  142.614894][    C3]  ? page_fault_oops+0x92/0x170
[  142.615515][    C3]  ? kernelmode_fixup_or_oops+0xb2/0x190
[  142.616234][    C3]  ? exc_page_fault+0xe0/0x180
[  142.616852][    C3]  ? asm_exc_page_fault+0x26/0x30
[  142.617484][    C3]  ? jffs2_free_inode+0x16/0x30 [jffs2]
[  142.618211][    C3]  ? kfree+0x4f/0x120
[  142.618719][    C3]  jffs2_free_inode+0x16/0x30 [jffs2]
[  142.619419][    C3]  rcu_do_batch+0x1b6/0x540
[  142.619989][    C3]  ? rcu_do_batch+0x154/0x540
[  142.620583][    C3]  rcu_core+0x19a/0x490
[  142.621105][    C3]  __do_softirq+0xce/0x2bc
[  142.621682][    C3]  irq_exit_rcu+0xaa/0xd0
[  142.622245][    C3]  sysvec_apic_timer_interrupt+0x80/0x90
[  142.622935][    C3]  </IRQ>
[  142.623321][    C3]  <TASK>
[  142.623692][    C3]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
~~~

**内核信息：**

**缺陷归属组件：**
JFFS2
**缺陷归属的版本：**
OLK-6.6
**缺陷简述：**
社区4fdcfab5b5537c21891e22e65996d4d0dd8ab4ca将f->target指向的内存释放流程延后到jffs2_alloc_inode()中,此时f->target指向的地址有可能是一个未经初始化的非法地址，可能会导致kfree(f->target)时触发OOPS

具体流程如下：

~~~
jffs2_iget()
  iget_locked()
    alloc_inode()
    find_inode_fast() //找到了一个并发创建的inode
    destroy_inode()  // 使用旧的inode 销毁新创建的inode
      i_callback
        jffs2_free_inode
          kfree(f->target)  //释放了一个未初始化的f->target指针
  jffs2_init_inode_info()  //初始化f->target指针为NULL（尚未执行）
~~~

**【环境信息】**
硬件信息
- 全平台

软件信息

网络信息

**【问题复现步骤】**，请描述具体的操作步骤

1. 修改内核代码

~~~diff
diff --git a/fs/inode.c b/fs/inode.c
index ae1a6410b53d..bd5fab59c494 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -22,7 +22,7 @@
 #include <linux/iversion.h>
 #include <trace/events/writeback.h>
 #include "internal.h"
-
+#include <linux/delay.h>
 /*
  * Inode locking rules:
  *
@@ -1317,6 +1317,11 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
 	if (inode) {
 		struct inode *old;
 
+		if (!strncmp(sb->s_id, "jffs2", 5) && ino != 1) {
+			printk("[%s] jffs2 get %lu\n", __func__, ino);
+			msleep(10*1000);
+		}
+
 		spin_lock(&inode_hash_lock);
 		/* We released the lock, so.. */
 		old = find_inode_fast(sb, head, ino);

diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 9fc297df8c75..de6f1111902b 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -41,6 +41,7 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
        f = kmem_cache_alloc(jffs2_inode_cachep, GFP_KERNEL);
        if (!f)
                return NULL;
+       f->target = 100; /* illegal value */
        return &f->vfs_inode;
 }
~~~

2. 内核编译选项

~~~
CONFIG_MTD=y
CONFIG_JFFS2_FS=m
CONFIG_MTD_NAND_NANDSIM=m
~~~

3. 执行测试代码

在jffs2文件系统中的不同目录下创建一个硬链接文件，然后drop cache删除inode cache，最后起两个进程分别访问这两个硬链接

~~~
ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB
modprobe nandsim dbg=1 id_bytes=$ID
mount -t jffs2 mtd1 /mnt

cd /mnt
touch a
mkdir dir
ln a dir/b
cd dir
echo 2 > /proc/sys/vm/drop_caches
stat b &
stat ../a &
~~~

**【实际结果】**，请描述出问题的结果和影响

~~~
[  142.578595][    C3] BUG: unable to handle page fault for address: fffffe5f5d000008
[  142.580779][    C3] #PF: supervisor read access in kernel mode
[  142.582432][    C3] #PF: error_code(0x0000) - not-present page
[  142.584095][    C3] PGD 43ffc7067 P4D 43ffc7067 PUD 0 
[  142.585564][    C3] Oops: 0000 [#1] PREEMPT SMP PTI
[  142.586967][    C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.6.0+ #48
[  142.588868][    C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[  142.591535][    C3] RIP: 0010:kfree+0x4f/0x120
[  142.593450][    C3] Code: 80 48 01 d8 0f 82 df 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 1b c5 46 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 f9 c4 46 01 <48> 8b 50 08 48 89 c7 f6 c2 01 06
[  142.597604][    C3] RSP: 0018:ffffb97240180ed0 EFLAGS: 00010286
[  142.598905][    C3] RAX: fffffe5f5d000000 RBX: 0000000000000064 RCX: 000000002a930003
[  142.600624][    C3] RDX: 00006f26c0000000 RSI: ffffffffc03c1bd6 RDI: 0000000000000064
[  142.602165][    C3] RBP: ffff90d9c03e6000 R08: 0000000000000000 R09: 0000000000038750
[  142.603363][    C3] R10: ffffffff832060c0 R11: 000000000000510b R12: ffff90dcefcf3d40
[  142.604610][    C3] R13: 0000000000000001 R14: 000000000000000a R15: 0000000000000000
[  142.605921][    C3] FS:  0000000000000000(0000) GS:ffff90dcefcc0000(0000) knlGS:0000000000000000
[  142.607340][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  142.608372][    C3] CR2: fffffe5f5d000008 CR3: 0000000057e1a000 CR4: 00000000000006e0
[  142.609627][    C3] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  142.610855][    C3] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  142.612098][    C3] Call Trace:
[  142.614105][    C3]  <IRQ>
[  142.614449][    C3]  ? __die+0x31/0x90
[  142.614894][    C3]  ? page_fault_oops+0x92/0x170
[  142.615515][    C3]  ? kernelmode_fixup_or_oops+0xb2/0x190
[  142.616234][    C3]  ? exc_page_fault+0xe0/0x180
[  142.616852][    C3]  ? asm_exc_page_fault+0x26/0x30
[  142.617484][    C3]  ? jffs2_free_inode+0x16/0x30 [jffs2]
[  142.618211][    C3]  ? kfree+0x4f/0x120
[  142.618719][    C3]  jffs2_free_inode+0x16/0x30 [jffs2]
[  142.619419][    C3]  rcu_do_batch+0x1b6/0x540
[  142.619989][    C3]  ? rcu_do_batch+0x154/0x540
[  142.620583][    C3]  rcu_core+0x19a/0x490
[  142.621105][    C3]  __do_softirq+0xce/0x2bc
[  142.621682][    C3]  irq_exit_rcu+0xaa/0xd0
[  142.622245][    C3]  sysvec_apic_timer_interrupt+0x80/0x90
[  142.622935][    C3]  </IRQ>
[  142.623321][    C3]  <TASK>
[  142.623692][    C3]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
~~~

**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel
关闭

内容风险标识

评论 (1)

GVPopenEuler/kernel关闭

内容风险标识