KSMBD kernel crash issue on Android

Question

KSMBD kernel crash issue on Android

bahubali-bg opened this issue 9 months ago · 11 comments

We have enabled KSMBD and CIFS kernel modules on Android.
One android device running with KSMBD server and second device running with CIFS.
Second device(client) successfully mounted remote drive using below mentioned command,
mount -t cifs //192.168.68.148/media -o username=root,password=root /mnt/media

When we try to create directory on client device, kernel is crashing. Below is the stack trace for the same.

UPLOAD CAUSE = KERNEL PANIC / PANIC = Oops - BUG: Fatal exception / PC = __list_add_valid+0x9c/0xcc / BUG = lib/list_debug.c:26 / ESR = BRK

@ Ramdump Auto Comment
@ SM-S926B / s5e9945 EVT 1.2 / PARA0042 / ------------ / NZZTF / 3 / 4
@ -------------------- / -------------- / REV 17 / 12.0G SEC / RST_STAT(0x40000000) / KP (3)(K3D0S0P0) [739] TMU 52,52,
@ VER 12 / AP S926BXXE1YXAG V 77076478 M 77076460 / CP

@= KERNEL PANIC / PANIC = Oops - BUG: Fatal exception / PC = __list_add_valid+0x9c/0xcc / BUG = lib/list_debug.c:26 / ESR = BRK

@ Power

MRST (M) , (S) PWRHOLD,PWROND
MAIN ONSRC: 08 00
MAIN OFFSRC: 00 00
MAIN INT: 00 90 00 00 00 02 10 FFFFFFFF
MAIN STATS: FFFFFFFF FFFFFFFF
SUB OFFSRC: 30 00
SUB INT: 40 00 00 00 02 FFFFFFFF FFFFFFFF
SUB STATS: FFFFFFFF

@ Freq

LIT : [ 479.861579] 1536Mhz -> 1728Mhz
MDL : [ 479.855738] 1920Mhz -> 2112Mhz
MDH : [ 479.874047] 1440Mhz -> 2112Mhz
BIG : [ 479.880980] 864Mhz -> 672Mhz
MIF : [ 479.858842] 2730Mhz -> 3172Mhz
INT : [ 479.877866] 533Mhz -> 267Mhz
G3D : [ 387.629584] 315Mhz -> 252Mhz
DSU : [ 479.881386] 1344Mhz -> 1440Mhz

@ Summary

[ 26.698180] [0: htsd: 1026] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
[ 38.069175]I[0: irq/375-dwc3: 1939] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602
[ 51.229883]I[0: irq/375-dwc3: 3587] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602
[ 79.076405] [7: reader: 8942] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602
[ 81.593126] [8: HwBinder:729_4: 1583] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602
[ 85.677035] [4: reader: 9827] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602
[ 90.223234] [7: HwBinder:729_2: 760] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:602

[ 479.894486] [3: kworker/3:0:20954] list_add corruption. next is NULL.
[ 479.894595] [3: kworker/3:0:20954] kernel BUG at lib/list_debug.c:26!

[ 479.910195] [3: kworker/3:0:20954] PC is at __list_add_valid+0x9c/0xcc
[ 479.910234] [3: kworker/3:0:20954] LR is at __list_add_valid+0x9c/0xcc
[ 479.917773] [3: kworker/3:0:20954] Kernel panic - not syncing: Oops - BUG: Fatal exception

[ 479.917394] [3: kworker/3:0:20954] Call trace:
[ 479.917414] [3: kworker/3:0:20954] __list_add_valid+0x9c/0xcc
[ 479.917439] [3: kworker/3:0:20954] fuse_link_write_file+0x80/0xd0
[ 479.917463] [3: kworker/3:0:20954] fuse_finish_open+0x168/0x19c
[ 479.917486] [3: kworker/3:0:20954] fuse_open_common+0x320/0x644
[ 479.917509] [3: kworker/3:0:20954] fuse_dir_open+0x14/0x20
[ 479.917532] [3: kworker/3:0:20954] do_dentry_open+0x480/0x7e0
[ 479.917560] [3: kworker/3:0:20954] dentry_open+0x80/0xb0
[ 479.917585] [3: kworker/3:0:20954] smb2_open+0x113c/0x20c0
[ 479.917610] [3: kworker/3:0:20954] handle_ksmbd_work+0x4f8/0x6d8
[ 479.917636] [3: kworker/3:0:20954] process_one_work+0x3d0/0x874
[ 479.917661] [3: kworker/3:0:20954] worker_thread+0x414/0x694
[ 479.917685] [3: kworker/3:0:20954] kthread+0x184/0x1a4
[ 479.917707] [3: kworker/3:0:20954] ret_from_fork+0x10/0x20

Below are the configuration for the same,
[media]
; share parameters
force group = root
force user = root
path = /storage/emulated/0/DCIM/Camera
read only = no

Please provide your inputs to resolve the same.

Answer 1 · 2024-02-13T13:11:28.000Z

Can you explain why you use ksmbd on Android ? Is there any use-case on Android ?

Answer 2 · 2024-02-13T15:26:24.000Z

Thank you for your response!!!

1). We are exploring file sharing use-case by enabling KSMBD feature for android.

2). Is KSMBD already verified for Android ?

3). We tried by enabling below kernel configurations on android to verify file sharing use-case, please let us know if any other modules needs to be enabled.

#DAX
CONFIG_FS_DAX=y
CONFIG_FUSE_DAX=y

CIFS

CONFIG_CIFS=y
CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
CONFIG_CIFS_UPCALL=y
CONFIG_CIFS_XATTR=y
CONFIG_CIFS_POSIX=y
CONFIG_CIFS_DEBUG=y
CONFIG_CIFS_DEBUG2=y
CONFIG_CIFS_DEBUG_DUMP_KEYS=y
CONFIG_CIFS_DFS_UPCALL=y
CONFIG_CIFS_SWN_UPCALL=y
CONFIG_CIFS_FSCACHE=y

SMB

CONFIG_INFINIBAND=y
CONFIG_INFINIBAND_ADDR_TRANS=y
CONFIG_SMB_SERVER=y
CONFIG_SMB_SERVER_SMBDIRECT=y
CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y
CONFIG_SMB_SERVER_KERBEROS5=y

#SMBFS
CONFIG_SMBFS=y

Thank you.

Answer 3 · 2024-02-13T23:16:15.000Z

1). We are exploring file sharing use-case by enabling KSMBD feature for android.
Sound great:)

2). Is KSMBD already verified for Android ?
I don't know google developer did it.

3). We tried by enabling below kernel configurations on android to verify file sharing use-case, please let us know if any other modules needs to be enabled.
If your device doesn't have RDMA NIC, CONFIG_SMB_SERVER_SMBDIRECT=y config is not needed.

[ 479.917439] [3: kworker/3:0:20954] fuse_link_write_file+0x80/0xd0
kernel oops happen in fuse driver, not ksmbd. I have a few questions on your test env.

What kernel version are you testing on ?
share directory seems to be located in user level filesystem(i.e. fuse). what type filesystem is it ? NTFS ?

When I have tried to test ksmbd & fuse NTFS before, there was no issue.
If you give more information to me, I will try it with list debug enabling again.

Answer 4 · 2024-02-14T07:27:09.000Z

Thank you for your response!!!

We are testing with Kernel version: 6.1.43
Shared directory file system type is tmpfs (Kernel crash issue observed)
Create directory on client device is successful, when we changed the Shared path that is of type ext4 file system. (Kernel crash issue not observed)
Can you please share list of file system types supported by KSMBD?

Thank you...

Answer 5 · 2024-02-14T12:48:24.000Z

Okay, ksmbd should support all filesystem type. And your the backtrace from kernel oops said filesystem type is not tmpfs. It is showing fuse functions. I think that share directory in tmpfs seems to be mounted with usb storage. Can you show me logs from the mount command after mounting using cifs ?

like this..

linkinjeon@linkinjeon-System-Product-Name:~/git/smbd_work$ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,noexec,relatime,size=3946492k,nr_inodes=986623,mode=755,inode64)
...

Answer 6 · 2024-02-14T12:50:24.000Z

and please share the parameters of your ksmbd.conf

Answer 7 · 2024-02-15T08:01:45.000Z

Thanks for your response!!!

[KSMBD Server] Sorry for confusion. Shared directory file system type is "fuse". And mount logs for the same as below,
/dev/fuse on /storage/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other)
[KSMBD Server] ksmbd.conf is as below
[media]
; share parameters
force group = root
force user = root
path = /storage/emulated/0/DCIM/Camera
read only = no
[CIFS Client] Logs from the mount command after mounting using cifs,

/192.168.68.175/media on /mnt/media type cifs (rw,relatime,vers=3.1.1,cache=strict,username=root,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.68.175,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1)

Please let us know if you need any further information

Answer 8 · 2024-02-15T11:30:41.000Z

Okay, Can you tell me which userlevel filesystem is mounted using fuse driver ?

Answer 9 · 2024-02-15T12:26:10.000Z

Thanks for your response!!!

At KSMBD server device, /storage/emulated is mounted using fuse. Below are the mount logs for the same
/dev/fuse on /storage/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other)

And in ksmbd.conf, Shared path used is /storage/emulated/0/DCIM/Camera, ksmbd.conf file for the same is as below,
[media]
; share parameters
force group = root
force user = root
path = /storage/emulated/0/DCIM/Camera
read only = no

Please let us know if you need any further information

Answer 10 · 2024-02-15T13:27:29.000Z

Can you help me reproduce this on ubuntu or fedora ? how can I mount /dev/fuse like your env ?

Answer 11 · 2024-02-16T07:36:09.000Z

Thanks for your response!!!

We do not know how exactly /dev/fuse can be mounted on ubuntu.
But we will try reproduce the issue by mounting /dev/fuse on Ubuntu.

Please let us know, if you need any information on Android environment to analyse issue further .