linux-kernel - NULL pointer dereference in commit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Dec 2009 13:49:34 -0500
From:	Eric Paris <eparis@...hat.com>
To:	linux-kernel@...r.kernel.org, linux-nfs@...r.kernel.org
Subject: NULL pointer dereference in commit_tree() from Linus' Dec17 tree

I pulled from Linus Dec16 and didn't have problems.  This is a pull from
Dec17, plus some of my own patches which I'd be surprised to learn were
related.  I have an NFS mount in my fstab, I assume this is that being
mounted on boot.  I'll start a bisect if needed, but maybe someone will
know what they broke instantly....

[   16.140640] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[   16.141381] IP: [<ffffffff8114db7f>] commit_tree+0x6f/0x100
[   16.141381] PGD 0 
[   16.141381] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[   16.141381] last sysfs file: /sys/module/lockd/initstate
[   16.141381] CPU 1 
[   16.141381] Pid: 2413, comm: mount.nfs Not tainted 2.6.32-fanotify #32 /
[   16.141381] RIP: 0010:[<ffffffff8114db7f>]  [<ffffffff8114db7f>] commit_tree+0x6f/0x100
[   16.141381] RSP: 0018:ffff88007dfb1798  EFLAGS: 00010246
[   16.141381] RAX: ffff88007dfb1798 RBX: ffff88007dfb1798 RCX: ffff8800775962e8
[   16.141381] RDX: ffff88007dfb1730 RSI: ffff8800775962e8 RDI: ffff88007dfb1798
[   16.141381] RBP: ffff88007dfb17c8 R08: 0000000000000002 R09: 0000000000000000
[   16.141381] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   16.141381] R13: ffff880077596280 R14: ffff88007e6e6280 R15: 0000000000000000
[   16.141381] FS:  00007f05bdf0b700(0000) GS:ffff880004c00000(0000) knlGS:0000000000000000
[   16.141381] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   16.141381] CR2: 0000000000000018 CR3: 00000000777d3000 CR4: 00000000000006e0
[   16.141381] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   16.141381] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   16.141381] Process mount.nfs (pid: 2413, threadinfo ffff88007dfb0000, task ffff88007dc62430)
[   16.141381] Stack:
[   16.141381]  ffff8800775962e8 ffff8800775962e8 ffff880077596280 ffff88007e6e6280
[   16.141381] <0> ffff88007dfb1be8 ffff88007dfb17e8 ffff88007dfb1828 ffffffff8114e13b
[   16.141381] <0> 0000000000000000 ffff88007c307710 ffff88007dfb17e8 ffff88007dfb17e8
[   16.141381] Call Trace:
[   16.141381]  [<ffffffff8114e13b>] attach_recursive_mnt+0x16b/0x170
[   16.141381]  [<ffffffff8114e22b>] graft_tree+0xeb/0x120
[   16.141381]  [<ffffffff8114e294>] ? do_add_mount+0x34/0x140
[   16.141381]  [<ffffffff8114e354>] do_add_mount+0xf4/0x140
[   16.141381]  [<ffffffffa0270a9a>] nfs_follow_mountpoint+0x14a/0x490 [nfs]
[   16.141381]  [<ffffffff8102f64e>] ? kvm_clock_read+0x3e/0x70
[   16.141381]  [<ffffffff81012499>] ? sched_clock+0x9/0x10
[   16.141381]  [<ffffffff81245ca3>] ? selinux_inode_follow_link+0x83/0xb0
[   16.141381]  [<ffffffff8113e2d1>] do_follow_link+0x161/0x300
[   16.141381]  [<ffffffff8113dadb>] link_path_walk+0x3bb/0x670
[   16.141381]  [<ffffffff8113ddec>] path_walk+0x5c/0xc0
[   16.141381]  [<ffffffff8113deba>] vfs_path_lookup+0x6a/0xe0
[   16.141381]  [<ffffffffa0264f45>] nfs_follow_remote_path+0x35/0x110 [nfs]
[   16.141381]  [<ffffffff810927f0>] ? trace_hardirqs_on_caller+0x120/0x1a0
[   16.141381]  [<ffffffffa0266235>] ? nfs_do_root_mount+0x85/0xa0 [nfs]
[   16.141381]  [<ffffffffa0266235>] ? nfs_do_root_mount+0x85/0xa0 [nfs]
[   16.141381]  [<ffffffffa0266397>] nfs4_try_mount+0x77/0xd0 [nfs]
[   16.141381]  [<ffffffffa0267336>] nfs_get_sb+0x836/0xd10 [nfs]
[   16.141381]  [<ffffffff8109287d>] ? trace_hardirqs_on+0xd/0x10
[   16.141381]  [<ffffffff8114c8e6>] ? alloc_vfsmnt+0xc6/0x1a0
[   16.141381]  [<ffffffff8113025b>] ? __alloc_percpu+0xb/0x10
[   16.141381]  [<ffffffff81134d97>] vfs_kern_mount+0x77/0x180
[   16.141381]  [<ffffffff81134f0e>] do_kern_mount+0x4e/0x110
[   16.141381]  [<ffffffff8114ea9d>] do_mount+0x51d/0x7e0
[   16.141381]  [<ffffffff8114d24a>] ? copy_mount_options+0x10a/0x180
[   16.141381]  [<ffffffff8114edea>] sys_mount+0x8a/0xd0
[   16.141381]  [<ffffffff8100ae02>] system_call_fastpath+0x16/0x1b
[   16.141381] Code: 55 d0 48 83 ea 68 eb 0f 4c 89 a2 c0 00 00 00 48 8b 52 68 48 83 ea 68 48 8b 42 68 0f 18 08 48 8d 42 68 48 39 d8 75 e1 48 8b 4d d0 <49> 8b 74 24 18 48 39 c1 74 15 48 8b 16 48 8b 45 d8 48 89 0e 48

View attachment "dmesg" of type "text/plain" (35330 bytes)

View attachment "config" of type "text/x-mpsub" (64381 bytes)