Bug#1043078: linux-image-6.3.0-2-amd64: kernel NULL pointer dereference with MD write-back journal

[Salvatore Bonaccorso <carnil@debian.org>]

Control: tags -1 + moreinfo

On Sat, Aug 05, 2023 at 12:45:18PM -0700, Corey Hickey wrote:
> Package: src:linux
> Version: 6.3.11-1
> Severity: normal
> 
> Dear Maintainer,
> 
> I was testing RAID-5 write-back journal (AKA cache) for the first time.
> 
> https://docs.kernel.org/driver-api/md/raid5-cache.html
> 
> I experienced a NULL pointer dereference early in the process.
> 
> -------------------- steps leading up to the crash -------------------
> 
> Make a RAID-1 from a pair of SSDs.
> 
> $ sudo mdadm --create /dev/md101 -l 1 -n 2 /dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H60631*
> 
> Make a RAID-5 containing the journal and three block device (one of
> which is, in turn a RAID). Size is restricted to 10 GB for testing
> purposes.
> 
> $ sudo mdadm --create /dev/md5 -n 3 -l 5 -z 10G --write-journal /dev/md101 -c 128K /dev/disk/by-id/ata-TOSHIBA_HDWG21C_* /dev/md3
> 
> I waited for the RAID to re-sync (this is necessary in order to enable
> write-back jornal mode, though not documented).
> 
> Enable write-back mode:
> 
> $ echo write-back | sudo tee /sys/block/md5/md/journal_mode
> 
> Test writes to the RAID-5 via dd:
> 
> $ sudo dd if=/dev/zero of=/dev/md5 iflag=fullblock oflag=direct bs=1M count=10240
> 
> ------------------------ observed behavior --------------------------
> Writes proceded at 100 +/- 4 MB/sec to the journal disks.
> Writes proceded at 29 +/- 1 MB/sec to the RAID-5 member devices.
> This lasted for 50 +/1 1 second, at which point writes stopped and the
> kernel printed an error:
> BUG: kernel NULL pointer dereference, address: 0000000000000157

If possible can you verify the issue is still present in either the
newest 6.4.y upstream or mainline (or nearest to that, the
6.5~rc4-1~exp1 in experimental)?

If so can you report the issue upstream and link back here the
upstream report?

Regards,
Salvatore