From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD059C02198 for ; Sat, 8 Feb 2025 12:25:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D3921280001; Sat, 8 Feb 2025 07:25:37 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CD8106B0092; Sat, 8 Feb 2025 07:25:37 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B3B9C280001; Sat, 8 Feb 2025 07:25:37 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 90DB16B008C for ; Sat, 8 Feb 2025 07:25:37 -0500 (EST) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 2FC66142372 for ; Sat, 8 Feb 2025 12:25:37 +0000 (UTC) X-FDA: 83096698314.12.6AD1FFC Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) by imf27.hostedemail.com (Postfix) with ESMTP id 0D80F40003 for ; Sat, 8 Feb 2025 12:25:34 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jhQy+bI1; spf=pass (imf27.hostedemail.com: domain of grawity@gmail.com designates 209.85.208.172 as permitted sender) smtp.mailfrom=grawity@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1739017535; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Vf7UCe2+gJ/ZwuZ0utuOhvytI5Khd0c+ZEq76ketdUc=; b=gT/GV+7fRNtoF8s3HpPEZPFdDrvwBz0cUTKCF9FF2lDD9a5T4qc9kZs8vndrAeSxZMuRwE MgkOotns7zGcMh/t/l/De707jrz24rIgUpD3bz1lH9Ujf+aJHYGUwIZx4ptf81oyLqAYwP aYgfFTSkumeSCs+JE7gsIrTtwsLiDs4= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jhQy+bI1; spf=pass (imf27.hostedemail.com: domain of grawity@gmail.com designates 209.85.208.172 as permitted sender) smtp.mailfrom=grawity@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1739017535; a=rsa-sha256; cv=none; b=Byrb5VznLjCxQmgnxxtk8U5fSJC6a01j+5ibh/7SsFPbvTLRBqcD9uauOM5oC19VHMyLFB G9bT6pi895kkbkjqKgSuJr0+l/mmXI29YDHx72B8sorUj5xBVw7dLJBVvZnVV49lGhspra 4nR607GM6ybQtP22pOgc+1/Wp1fCbd8= Received: by mail-lj1-f172.google.com with SMTP id 38308e7fff4ca-30795988ebeso27820921fa.3 for ; Sat, 08 Feb 2025 04:25:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739017533; x=1739622333; darn=kvack.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=Vf7UCe2+gJ/ZwuZ0utuOhvytI5Khd0c+ZEq76ketdUc=; b=jhQy+bI1RQXVWq7eMUxNRAJ4p6ShdmAqWEmsY7RDW8Sa0v7Skx2A1KC+K2e+dUB7Om IhMzQKqAKsCb2qYreiOlZc1Da3coDPJFycTBPEntOR7AJqRFDCFlumHWRTB1xXaO0ZFR WWI0xbMDck+vXb7b3cXMGvQD0LbXcW2wu0pp126X5dDy5W2kTB0VzxyDMz7LbJ/g1ppz gmwYkwpsITbsFqk4UgRC1XS0HpoCe6VYfX6lxCZvCnkMuv8lxHy8WM1lD/9Az4Y5zVyY cK47z1u0mIziqbie/WnySZSEXcCOMjIhKO+UY1XMH3Ams0i75MvFvE1phk0GJ/NzEwX1 DaPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739017533; x=1739622333; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Vf7UCe2+gJ/ZwuZ0utuOhvytI5Khd0c+ZEq76ketdUc=; b=tNIRRBGHQ8RN+1f70fLZuMzF2xuvML3hKKIJR5C7S9wkkESsTM9S63QtC89h52CyiY bkOYEEFLFRnA7Qk3X5wG957t9QZSQJQ3ttUVBrzNongvgCiy2DHCLxTMOgy4YdxaDNY7 XEbE+L/9LQnjNABy0cdawCZ0aAkBtR3qQsewzSt7OFKzOOXI5D2oOug/HPWbTfD73roR 1vbGaEjhv+/tI7lTv4EV94w8HWjWcVLkVfq+nhWa9LHLktfn1047HNu7M1KwGKxR9EqR fdrFt402et/V80wmvwaYhXZ/uvEm5pTlIx7HjrYFN8RQ8s/vgdVq4iTr3erojLGAtybc Z5ew== X-Forwarded-Encrypted: i=1; AJvYcCWJa3UqRbZC5H4x8AUHiYD9ldwGF+X2I/T6HSVQ3asfcdm6P1M8/veFfp1QePnapg+81CYjnZMhFw==@kvack.org X-Gm-Message-State: AOJu0YzvnoQTcmgG2eD9PG/L966dCuGL+Cj11fBHIu5nm9xpE+jVr5Oi v/FBolaYfSwepwhS9u75T/gbXobJAYtm/u8YX+F/Q5+gV2Y4eqaf X-Gm-Gg: ASbGncvYYuW0OdERCfwtoaFr21BwYg8+IUUo0R3oGbapsHMjpDMH7mIawUDO4DAcd2v UkIqR7irrRqznRvto9Ocn/nU5x+hln+btMlItXXC6zvGQSCppATuKZ8hLFN7cxISxE0Sg6y3BMA 6gN42p+EbRe9G9lsDQxA5rmhVOCX3HpIL8UUVYvP/xAgF+AATFf5D4joUUm48NSYGrIKCGKUlhO Lty2sqKWhLes+lvo6q4ZEaZ486Nvi5WovnLH8NHj11icHeIRi6FRezCDxm0kerOCgk5rlVTqxTU IxlLLORD/yYBgMRAGOFxaBN7HLhV+xRDIOx/00As X-Google-Smtp-Source: AGHT+IEKSXFs+VKuDDwV+S1yCbrtaX4ioZyasHRW6SDx+XrDhvhm7KyK69cSIttc8f/uOAOsSAabZQ== X-Received: by 2002:a05:6512:3988:b0:545:58e:e543 with SMTP id 2adb3069b0e04-545058ef015mr489528e87.21.1739017532610; Sat, 08 Feb 2025 04:25:32 -0800 (PST) Received: from [10.147.2.13] ([85.206.91.33]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-54410554276sm705168e87.67.2025.02.08.04.25.31 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 08 Feb 2025 04:25:32 -0800 (PST) Message-ID: Date: Sat, 8 Feb 2025 14:25:30 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [REGRESSION][BISECTED] Crash with Bad page state for FUSE/Flatpak related applications since v6.13 To: Bernd Schubert , Joanne Koong Cc: Vlastimil Babka , Miklos Szeredi , Matthew Wilcox , Christian Heusel , Josef Bacik , Miklos Szeredi , regressions@lists.linux.dev, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm References: <2f681f48-00f5-4e09-8431-2b3dbfaa881e@heusel.eu> <03eb13ad-03a2-4982-9545-0a5506e043d0@suse.cz> <94df7323-4ded-416a-b850-41e7ba034fdc@bsbernd.com> Content-Language: en-US, lt From: =?UTF-8?Q?Mantas_Mikul=C4=97nas?= Autocrypt: addr=grawity@gmail.com; keydata= xsFNBErsM2sBEACY4zLqEsnJ0r9vrjKrrVtbEsJe5Pe1dopj91UekdDzSNhJx5wgOZ4G7Zw2 Xm0w4JGPLqwTJ/0k4qJVcEKLnDfCxVlGEZLej7OSjcOI8ecRD8eZSez/n4+7C9pY+1+G0qFX AYAVfehVlAUaxRDWRpA1VMH7sCH5l6aXKOHLHc2fdrCK0vPCNVYxhqeXC00kasappbeM3YtE WtBrletWiWFv80ivy6OMXc2p/v1ke3HQnOaIN6exFimHdoz7tosyxevKvDSh44nZ/k1m7m4G 7V7jVFJYjqk0l+6ExB/behKPREP3bQcoa7OvkupTE1gK4p6PnTI7vozQgrYPjTfv70uRB5cY gIhtix71EgT3vpwpnkLNSCo1abuTbqibiOlLA8aoW2U3qcY6850RG9eYt/GFBJFgD76vwbiL NyOwnOtntY+JsUR2LxxI49u4U75Uz3BPDRbch+GfkYxxMZmaJEQs7OUDpILO4IGbGRfLxA0D OtTS4Eyprre7xaNJGqQ+mMA0eAX3EbvL7V2EUri37ctMpleg8hYtQJbABYNJgiyHrb9ZAbEH bBvxj96Fe7y2XxUey+j8vFWtX8fbHrCL1Epx7BoUDcxfnEko4dESEbfueaNiRzQAq903Do4x LlZMu//aEWcwqR8cxpXKIrXiodDPutBA2Jc3Z14CV++pXz70mwARAQABzSVNYW50YXMgTWlr dWzEl25hcyA8Z3Jhd2l0eUBnbWFpbC5jb20+wsGNBBMBCQA3AhsDAh4BAheABAsJCAcDFQkI BBYCAQAWIQQjV+EM709+0n4jOtXST2yywbUmMgUCYtPrBwIZAQAKCRDST2yywbUmMr93D/9p Vxlu+/eUXJ5FZOKR+zkvwicovVSSGi/X+6TTfrk6Puj9S/ao9oz7GyQK10n1c3Czd1HVT1TU P/n3HkLhh7lt/F+dCrLhKIDvf7Jpfby0UD3gxEzmuz+7d716+wXt2VPf3m4rvpwHt7T+pVak w/5LFIMVc5FUo6mZrbWfCyeeUu/H9+vBV3SBh0OFwZZjYj+xdb2hGa9d2XKLulqt2uQ1HmYm KZfhi2FsE6vNV06ZstACX6zoRFdQ9CxEsRTz+virLGl4uz5Kd1HtpOHoKEcLgx12nOdBdOa+ A0LcYW0HTJ7brBiRRInj2+c25ZSwkmrtRw7qVNHVvsk80MXgTwTvbR7Y6ZfaPx2BLK6rMJXM E1KM4zn20oUMoAUCc8Z7ijkdzgJPn7smQAusJnv298QxdHvDyKo8Wic+QIkO89nS89ZpBTni 3L9IEv5SCgBRk6zxYhnVd+jLZb+GJFIC4KtQi5k77uyGVXOc1PJbumZ/1J7oPvJKLd8YONnK GMDmQ+FIka06cGYV3H7LaYzg6QZiimRPRzl4UfAVdI6bPIRG87whCIYl1xaaBynOaKBJokxc yuWRU4tCmaTMhMT2m+VkYwKBV9QfCtcIJtVGBoS1GEIay72+KbeNkdT4rAmLYgStpVCEbVdE c0np2ZX0v2euPawJYPIXuPW6+pZs4Fj+Jc7BTQRK7DNrARAAokxkRw/rlyI/5eG+Gqh3nQaC UhQ56Q2ms+wgVoCu+FAtOlrBJvXN8lgF7lXbH+SLTr20E2VveRAuj7I6kDuFCidK7NSsDH5l DccnNuvrlDVgd1ek9fIvRNaTnGaMcm0e4O2fiEDmkR3xgPWJF33Y1SXpmXrM+QBnDuk6jhJh cEXyoNaiuYAFDw60yvLapFaRfETqf3KEG6a2lFYVyh/O9uUUAWyEX8ZGqqkQJNVJbDDZCSw3 tnqt16szdYbvrHRifF2pGxDzGfOBZ21nIb9s7um2gdMp2/EnwkWQ4OV+qSvGHJ9Q/7wklR60 +SOakOkAAKgnCXcAZOPUdE44MPASJ750KWs+cf79enW6Ar5xgNgJo34CtPiLqcr7Bw+2T0MW vbOHbAc8+ONdPowYNzTNlPKXWzUuUTlpZQCqWlU1P6fbAnPib5HCQ5/NUXag74XUNnTol6hD /3Ne0lwFnvG0eL91uSLCtpYLsDM+36Pk+wCbgLDOxbvWjjUheG64muNaDDR+XlqeOJta2Fir MKuTq472+3GRmwUgufLAMlvYYguSNcXxDUbJWPAosLJgF6USiyeHhOi23sgHUdzERrOq+/Fb 6tuwnpP8YSXYqsm5FRZmoe5NYyRYEE89xQurTpAwQFuo5A4EsNoA9aomNtCXMk4KzsE05bzB xW/IEkki4F0AEQEAAcLBXwQYAQoACQUCSuwzawIbDAAKCRDST2yywbUmMk7PD/48FiijKQAa wE+/y0mVBDE7R5rxgwJZAyi97XjSwshEDq6rASQpQ0DnjHhUCZRc/otubeJ4Cf5muznZNAXD JzGEHOXRp65NaVoXLYltXW8N1D60WyGg5MY1m97/LG2i8lAjalFv6BDVpKur/rNcBCqdDENF lxI0V+f+X0CFiUeb0i8nZKvyhPVtZhs4FgaPVPW1CabvIC34fGrPKCwZUnrvMoh0LAgilmQ1 7cC0EuWQQ42UCvT80/zh45/zLGPheQFV24QoRfkD63AnI4hofNddEJAVbdYq2nmwt2lrrgMe Zmg01f3usvXD19UYJyWGhKspSjCIBfzBHliSsO647AOf8NAhMfJoYAUcB73oio/+SmedqQwH jKSZ0ujgPRaA1BzwJq2KFAEt78GWdi3+QJVLSY7qwmdJhQIM6tpLHjQZDkJ3t3WS9mQLXdo3 yjXbhu32fHP+D9wxj5zUSMGw6IXYwL3/0dSjjp7kCbz4WDCjY9VVJQXVqsATBFzj1h3e6DRi sUnXsKPg5dMb2/y57Eu+0uEYT+UDjUKsCrSv2fqL70GxsdM6GAnDOKjOZAKiAq7yIGFea172 YI5Vn8mvHV5B2d1d0C9b9BYq0ciZGchz+uvB6RHa4C+dvVDUIyhYqoaVgUopBBTqzUavkwuy aETxZy4lQ+jpsbG/q9fvS/sAZA== In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Rspam-User: X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 0D80F40003 X-Stat-Signature: mwrkzgw9cbfb3d8z6d49jsewkjexw9ki X-HE-Tag: 1739017534-37942 X-HE-Meta: U2FsdGVkX1+1USq2bBEOZI9svnoGtYgdYum6fa8FkbcS4zlphI0xgYziRICi7TdU1lh27lC0tojETE6lpR1/53jqtzi69Cw7XhbYs1US+5o90PMPSCHgnWNgszSpDCqBErgzwvfYrSS/ANtwO5ibycH3YPERcvH38adrYYhPnjxLGYik/tOd/CGpzh/FGO6voCHVNep7d5KiT4ruXDacj34VrdjfNNjvBM43PGd3K0+85VDoi174NICtRhgfmYGQAM1T9PSb38uagM9gNst+I03yk7gXrJQt7lFqujhqxa/rQf3LXTiEtoPe32skB4KoJz8+yDmkQdXfuB3JClYSABLgGsFwP6mrL0jel857m8Wywb2zxS5F64FRLdfGxveYgiznkKgo4tRnuM3WDGahISztDBe5q6y0D1zQTK5cnE3+3OhwgG699hYfpLX5iyegVmXrIS8MX0521eNiJxAotJ/+DDkF7BsjAoJ/GlVAlD76VQQcgGzk+X17hRjmofGki7P4XG9jAsXyosObky+CrONlo/xLInavIwTE8HzEGUfComT2Yn5DYnFhwFLGnfq0trEvpUtFAte0WYm1Uq84F540EzqyqJLGawLFsVkkwmLrZwZgVD5wPpuQ76GORjlPJR3SDRbi0aR/sev5tG76uRlT06wGLL4oh/g7o4PHLKcxNtTjaQNi/G95b3hjUBeu2rCNxTWqX91aprlReEfKdZSImRRcN3EowfU0g+cPRLRGBuluvTXvdD+DzJRYn1FBZ8ZAKUu9M1v1ByMKdwfCIGffQ7jxZ468FnlgcaLFMoIG5VyppbNkVd+RAKtR71wiGSNP4uOpQXK2KySCVSBY0UW6EG/slokKIYf3YNccbHgU3Idoi80guwPNdwOuABnhfocch9ERA1b935paAgc+6thlJeupUlt10jnOqrlwH0TCwpRQ4TFGLlswBnFdmUCjKoATh2HXjCr2aPdT8/e +j+79KwM 2UXzWTITqyw5DTaANyjrhF1uumtVaTvKFVwXugZGyb9TPkSCbx5D8jCGF07ts4b024dgx839At5RB2txHrDsJuE114OGKnjlXZV1kIX+gNEPD7Njv+ljEltmn76PRJOJv7W/CI6s7WnDEdTebjqhhWuiklk8XNI/doYEc2JntxcJAlXGjREORC0muVEqjeDB/oGBUVqi9//7kF3y5/W1JeKmv6ykg7AD8RDMLyXMZpCRGhOjoZ3VZ5EvlmjWDz8mT0c3RykwEvCiMJZJbjz7mYfQy+COTsJPjaQ7ZyjXtIRkYX917Q1IiSjU2+F2lwwG7X91XBZewyrbkcRoRRwBFTDUJim7Ihhlg1UNay7oQ60VkssytnH6n7vvknYC5oIC4tVCbE8FyMCISPpWRUx5RkotQf2Bq8urq65O0eoSNWuj2r//F4MYv62wNtwp0FY29Xfr/Pf4x19MvPFFpHOxu5WmxoIEJ8r7tXM5fYzjITUnE4a9m1oVVXuLo/PaER657aFUtWROxPzcR/uMaMVmYUGGC67y9YcqyGkxdrohQpT6QyUc85vjGlbh7R6YzpDEx6G3RvIhN1mH7y74kye8lUdw68w== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2025-02-08 2:02, Bernd Schubert wrote: > > > On 2/7/25 19:40, Joanne Koong wrote: >> On Fri, Feb 7, 2025 at 3:16 AM Bernd Schubert wrote: >>> >>> >>> >>> On 2/7/25 11:55, Vlastimil Babka wrote: >>>> On 2/7/25 11:43, Miklos Szeredi wrote: >>>>> On Fri, 7 Feb 2025 at 11:25, Vlastimil Babka wrote: >>>>> >>>>>> Could be a use-after free of the page, which sets PG_lru again. The list >>>>>> corruptions in __rmqueue_pcplist also suggest some page manipulation after >>>>>> free. The -1 refcount suggests somebody was using the page while it was >>>>>> freed due to refcount dropping to 0 and then did a put_page()? >>>>> >>>>> Can you suggest any debug options that could help pinpoint the offender? >>>> >>>> CONFIG_DEBUG_VM enables a check in put_page_testzero() that would catch the >>>> underflow (modulo a tiny race window where it wouldn't). Worth trying. >>> >>> I typically run all of my tests with these options enabled >>> >>> https://github.com/bsbernd/tiny-qemu-virtio-kernel-config >>> >>> >>> If Christian or Mantas could tell me what I need to install and run, I >>> could probably quickly give it a try. >>> >> >> Copying/pasting from [1], these are the repro steps that's listed: >> >> 1) Install Bottles: flatpak install flathub com.usebottles.bottles >> 2) Open Bottles and create a bottle >> 3) In a terminal open the kernel log using dmesg/journalctl in follow mode >> 4) Once the bottle has been initialized, open it, select "Run >> Executable" and point it at any Windows executable >> Note that at that same moment a BUG: Bad page state in process fuse >> mainloop error message will appear and the system will become >> unresponsive (keyboard and mouse might still work but you'll be unable >> to actually do anything, open or close any application, or even reboot >> or shutdown; you are able to ping the device and initiate an SSH >> connection but all it does is just display the banner) >> > > Thanks Joanne! Hmm, I found "wmplayer" in a c drive, but there doesn't > happen much > > 5241 pts/0 Ss 0:00 -bash > 5317 pts/1 S+ 0:00 /home/bernd/.var/app/com.usebottles.bottles/data/bottles/runners/soda-9.0-1/bin/wi > 5319 ? Ss 0:01 /home/bernd/.var/app/com.usebottles.bottles/data/bottles/runners/soda-9.0-1/bin/wi > 5321 pts/1 S+ 0:01 C:\windows\system32\wineboot.exe --init > 5345 ? Ssl 0:01 C:\windows\system32\services.exe > 5348 ? Ssl 0:00 C:\windows\system32\winedevice.exe > 5359 ? Ssl 0:01 C:\windows\system32\winedevice.exe > 5360 ? I 0:00 [kworker/u130:0-rpciod] > > It runs it, but no system issue. I had also tried "Obfuscate", but didn't > manage to feed it a file - it runs in the sandbox and no access to > my $HOME. That is the point -- the bug is triggered by using Flatpak's FUSE-based "sandboxed file access" mechanism. The sandboxed app is supposed to ask 'xdg-desktop-portal' to give it some file, which then lets you select a file and exposes it through its FUSE mount inside the sandbox (which is also visible at /run/user/1000/doc outside the sandbox). So the specific app probably doesn't matter, as long as it *is* in fact sandboxed without direct access to your $HOME, and as long as you have xdg-desktop-portal installed. I had suggested "Obfuscate" both because it was what originally led to the crash in my case, and because it's a fairly basic app where opening a file happens to be step 1 of its usual workflow so it's quick to test. Other similar ones might be: https://flathub.org/apps/com.belmoussaoui.ashpd.demo ("File chooser") The actual FUSE code is at: https://github.com/flatpak/xdg-desktop-portal/blob/main/document-portal/document-portal-fuse.c#L2041 I guess any other filesystem that relies on libfuse's direct splice support would also be able to repro? I don't know if there are any.