lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Sun, 8 Jan 2012 22:06:41 +0800
From:	Wu Fengguang <wfg@...ux.intel.com>
To:	Yongqiang Yang <xiaoqiangnk@...il.com>
Cc:	LKML <linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org,
	linux-ext4@...r.kernel.org
Subject: Re: 3.2.0-rc5 NULL dereference BUG

On Thu, Jan 05, 2012 at 10:45:09AM +0800, Yongqiang Yang wrote:
> On Thu, Jan 5, 2012 at 10:43 AM, Wu Fengguang <fengguang.wu@...el.com> wrote:
> > On Thu, Jan 05, 2012 at 10:37:15AM +0800, Yongqiang Yang wrote:
> >> On Thu, Jan 5, 2012 at 10:34 AM, Wu Fengguang <fengguang.wu@...el.com> wrote:
> >> > Yongqiang,
> >> >
> >> > I noticed that Linus's master does not contain your initial fix
> >> >
> >> >        ext4: do not reference pa_inode from group_pa
> >> >
> >> > Is that *replaced* by the patches you mentioned below?
> >> nope.   They are different stories.   [ext4: do not reference pa_inode
> >> from group_pa] is merged into Ted's tree and has not been pushed to
> >> Linus.  You can have a loot at Ted's tree
> >> http://git.kernel.org/?p=linux/kernel/git/tytso/ext4.git;a=summary
> >>
> >> [ext4: do not reference pa_inode from group_pa] is merged after the
> >> following patches.
> >
> > Thanks for the explanation. Is it planned to be pushed before the 3.2
> > release?
> I am not sure.  I am guessing it will be pushed before 3.2 release:-).

This bug appears again in 3.2. I'd recommend to send the patch to
-stable once it hits 3.3-rcX.

Thanks,
Fengguang

[  613.505459] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
[  613.506004] IP: [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  613.506004] PGD 203e2e067 PUD 203e2d067 PMD 0
[  613.506004] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[  613.506004] CPU 1
[  613.506004] Modules linked in:
[  613.506004]
[  613.506004] Pid: 4112, comm: flush-8:80 Not tainted 3.2.0 #313 Supermicro X7DW3/X7DWN
[  613.506004] RIP: 0010:[<ffffffff81208933>]  [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  613.506004] RSP: 0018:ffff880211981590  EFLAGS: 00010286
[  613.506004] RAX: ffffe8ffff0091e8 RBX: ffff8801c5517e70 RCX: ffff880211954500
[  613.506004] RDX: 0000000000000000 RSI: 0000000000000286 RDI: ffffe8ffff0091e8
[  613.506004] RBP: ffff880211981670 R08: ffff8802119815b0 R09: 0000000000000000
[  613.506004] R10: ffffe8fffee087b0 R11: ffffffff8121fba3 R12: ffffffff81f62ff8
[  613.506004] R13: ffff880211981720 R14: ffff8802080ece50 R15: ffff880211981740
[  613.506004] FS:  0000000000000000(0000) GS:ffff880226000000(0000) knlGS:0000000000000000
[  613.506004] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  613.506004] CR2: 0000000000000028 CR3: 00000001efa02000 CR4: 00000000000006e0
[  613.506004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  613.506004] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  613.506004] Process flush-8:80 (pid: 4112, threadinfo ffff880211980000, task ffff880211954520)
[  613.506004] Stack:
[  613.506004]  0000000000000000 0000000000000003 ffff880211981620 ffff8802119815b0
[  613.506004]  0000000000000000 0000000000000000 0000000000000000 0000000000000000
[  613.506004]  ffff8802119816c0 0000000000000000 0000000000000000 0000000000000000
[  613.506004] Call Trace:
[  613.506004]  [<ffffffff8121d110>] ? ext4_mb_release_group_pa+0x40/0xfe
[  613.506004]  [<ffffffff8121d110>] ext4_mb_release_group_pa+0x40/0xfe
[  613.506004]  [<ffffffff8121fbe3>] ext4_mb_discard_group_preallocations+0x355/0x3eb
[  613.506004]  [<ffffffff81222b32>] ext4_mb_new_blocks+0x2fd/0x422
[  613.506004]  [<ffffffff8121a495>] ext4_ext_map_blocks+0x146f/0x1969
[  613.506004]  [<ffffffff810a3339>] ? local_clock+0x41/0x5a
[  613.506004]  [<ffffffff810aec1b>] ? __lock_acquire+0x564/0x932
[  613.506004]  [<ffffffff810aec1b>] ? __lock_acquire+0x564/0x932
[  613.506004]  [<ffffffff811f601b>] ? ext4_map_blocks+0x103/0x221
[  613.506004]  [<ffffffff811f604c>] ext4_map_blocks+0x134/0x221
[  613.506004]  [<ffffffff811f9857>] mpage_da_map_and_submit+0xef/0x404
[  613.506004]  [<ffffffff811fa2cc>] ext4_da_writepages+0x350/0x505
[  613.506004]  [<ffffffff8103c24b>] ? sched_clock+0x9/0xd
[  613.506004]  [<ffffffff810ae168>] ? lock_release_holdtime+0xa3/0xac
[  613.506004]  [<ffffffff811137b4>] do_writepages+0x24/0x2d
[  613.506004]  [<ffffffff811786a5>] writeback_single_inode+0x126/0x2b4
[  613.506004]  [<ffffffff81178f03>] writeback_sb_inodes+0x17f/0x229
[  613.506004]  [<ffffffff81179657>] wb_writeback+0x130/0x23a
[  613.506004]  [<ffffffff81179982>] wb_do_writeback+0x8f/0x1b7
[  613.506004]  [<ffffffff81179b5d>] ? bdi_writeback_thread+0xb3/0x215
[  613.506004]  [<ffffffff81179b36>] bdi_writeback_thread+0x8c/0x215
[  613.506004]  [<ffffffff81179aaa>] ? wb_do_writeback+0x1b7/0x1b7
[  613.506004]  [<ffffffff8109db30>] kthread+0x8e/0x96
[  613.506004]  [<ffffffff819ec584>] kernel_thread_helper+0x4/0x10
[  613.506004]  [<ffffffff819e3974>] ? retint_restore_args+0x13/0x13
[  613.506004]  [<ffffffff8109daa2>] ? __init_kthread_worker+0x5b/0x5b
[  613.506004]  [<ffffffff819ec580>] ? gs_change+0x13/0x13
[  613.506004] Code: 89 c2 4c 89 85 38 ff ff ff 48 8d 4d ec 41 0f b7 74 24 48 e8 ed 06 7e 00 4c 8b 85 38 ff ff ff 48 85 c0 74 50 48 8b 93 a0 00 00 00 <48> 8b 52 28 8b 52 10 89 50 0c 48 8b 93 80 00 00 00 48 89 50 10
[  613.506004] RIP  [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  613.876032]  RSP <ffff880211981590>
[  613.876032] CR2: 0000000000000028
[  613.882620] ---[ end trace af3c59e20d0fb446 ]---
[  613.882624] ------------[ cut here ]------------
[  613.882630] WARNING: at /c/wfg/linux/kernel/exit.c:898 do_exit+0x67/0x76e()
[  613.882632] Hardware name: X7DW3
[  613.882633] Modules linked in:
[  613.882636] Pid: 4112, comm: flush-8:80 Tainted: G      D      3.2.0 #313
[  613.882638] Call Trace:
[  613.882643]  [<ffffffff8107dca4>] warn_slowpath_common+0x85/0x9d
[  613.882646]  [<ffffffff8107f42e>] ? kmsg_dump+0x8a/0x10c
[  613.882649]  [<ffffffff8107dcd6>] warn_slowpath_null+0x1a/0x1c
[  613.882651]  [<ffffffff81081417>] do_exit+0x67/0x76e
[  613.882653]  [<ffffffff8107f49f>] ? kmsg_dump+0xfb/0x10c
[  613.882656]  [<ffffffff8107f42e>] ? kmsg_dump+0x8a/0x10c
[  613.882660]  [<ffffffff819e4629>] oops_end+0xbe/0xc6
[  613.882664]  [<ffffffff81056e15>] no_context+0x184/0x193
[  613.882667]  [<ffffffff81056fed>] __bad_area_nosemaphore+0x1c9/0x1e9
[  613.882670]  [<ffffffff8103c24b>] ? sched_clock+0x9/0xd
[  613.882674]  [<ffffffff810a315b>] ? sched_clock_local+0x12/0x75
[  613.882677]  [<ffffffff81057020>] bad_area_nosemaphore+0x13/0x15
[  613.882679]  [<ffffffff819e69e7>] do_page_fault+0x213/0x431
[  613.882684]  [<ffffffff811084fc>] ? perf_output_begin+0x1c2/0x1f5
[  613.882686]  [<ffffffff8103c1fb>] ? native_sched_clock+0x29/0x70
[  613.882688]  [<ffffffff8103c24b>] ? sched_clock+0x9/0xd
[  613.882693]  [<ffffffff8140a92d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[  613.882696]  [<ffffffff8121fba3>] ? ext4_mb_discard_group_preallocations+0x315/0x3eb
[  613.882699]  [<ffffffff819e3b85>] page_fault+0x25/0x30
[  613.882702]  [<ffffffff8121fba3>] ? ext4_mb_discard_group_preallocations+0x315/0x3eb
[  613.882705]  [<ffffffff81208933>] ? perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  613.882708]  [<ffffffff8121d110>] ? ext4_mb_release_group_pa+0x40/0xfe
[  613.882710]  [<ffffffff8121d110>] ext4_mb_release_group_pa+0x40/0xfe
[  613.882712]  [<ffffffff8121fbe3>] ext4_mb_discard_group_preallocations+0x355/0x3eb
[  613.882716]  [<ffffffff81222b32>] ext4_mb_new_blocks+0x2fd/0x422
[  613.882719]  [<ffffffff8121a495>] ext4_ext_map_blocks+0x146f/0x1969
[  613.882721]  [<ffffffff810a3339>] ? local_clock+0x41/0x5a
[  613.882725]  [<ffffffff810aec1b>] ? __lock_acquire+0x564/0x932
[  613.882728]  [<ffffffff810aec1b>] ? __lock_acquire+0x564/0x932
[  613.882731]  [<ffffffff811f601b>] ? ext4_map_blocks+0x103/0x221
[  613.882733]  [<ffffffff811f604c>] ext4_map_blocks+0x134/0x221
[  613.882736]  [<ffffffff811f9857>] mpage_da_map_and_submit+0xef/0x404
[  613.882739]  [<ffffffff811fa2cc>] ext4_da_writepages+0x350/0x505
[  613.882741]  [<ffffffff8103c24b>] ? sched_clock+0x9/0xd
[  613.882744]  [<ffffffff810ae168>] ? lock_release_holdtime+0xa3/0xac
[  613.882747]  [<ffffffff811137b4>] do_writepages+0x24/0x2d
[  613.882751]  [<ffffffff811786a5>] writeback_single_inode+0x126/0x2b4
[  613.882753]  [<ffffffff81178f03>] writeback_sb_inodes+0x17f/0x229
[  613.882756]  [<ffffffff81179657>] wb_writeback+0x130/0x23a
[  613.882759]  [<ffffffff81179982>] wb_do_writeback+0x8f/0x1b7
[  613.882761]  [<ffffffff81179b5d>] ? bdi_writeback_thread+0xb3/0x215
[  613.882764]  [<ffffffff81179b36>] bdi_writeback_thread+0x8c/0x215
[  613.882767]  [<ffffffff81179aaa>] ? wb_do_writeback+0x1b7/0x1b7
[  613.882769]  [<ffffffff8109db30>] kthread+0x8e/0x96
[  613.882773]  [<ffffffff819ec584>] kernel_thread_helper+0x4/0x10
[  613.882776]  [<ffffffff819e3974>] ? retint_restore_args+0x13/0x13
[  613.882779]  [<ffffffff8109daa2>] ? __init_kthread_worker+0x5b/0x5b
[  613.882782]  [<ffffffff819ec580>] ? gs_change+0x13/0x13
[  613.882783] ---[ end trace af3c59e20d0fb447 ]---
[  613.882796] flush-8:80 used greatest stack depth: 2352 bytes left
[  614.468204] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
[  614.469003] IP: [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  614.469003] PGD 211942067 PUD 21be9d067 PMD 0
[  614.469003] Oops: 0000 [#2] SMP DEBUG_PAGEALLOC
[  614.469003] CPU 3
[  614.469003] Modules linked in:
[  614.469003]
[  614.469003] Pid: 4117, comm: flush-8:160 Tainted: G      D W    3.2.0 #313 Supermicro X7DW3/X7DWN
[  614.469003] RIP: 0010:[<ffffffff81208933>]  [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  614.469003] RSP: 0018:ffff880211a17590  EFLAGS: 00010286
[  614.469003] RAX: ffffe8ffff4091e8 RBX: ffff8801c55179d8 RCX: ffff8802119b2200
[  614.469003] RDX: 0000000000000000 RSI: 0000000000000286 RDI: ffffe8ffff4091e8
[  614.469003] RBP: ffff880211a17670 R08: ffff880211a175b0 R09: 0000000000000000
[  614.469003] R10: ffffe8fffee08ff8 R11: ffffffff8121fba3 R12: ffffffff81f62ff8
[  614.469003] R13: ffff880211a17720 R14: ffff8802080ece50 R15: ffff8801c5478000
[  614.560062] FS:  0000000000000000(0000) GS:ffff880226400000(0000) knlGS:0000000000000000
[  614.560062] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  614.560062] CR2: 0000000000000028 CR3: 0000000211945000 CR4: 00000000000006e0
[  614.560062] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  614.560062] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  614.560062] Process flush-8:160 (pid: 4117, threadinfo ffff880211a16000, task ffff8802119b2290)
[  614.610013] Stack:
[  614.610013]  ffff880218a5a020 0000000000000000 ffff8801f88d9858 ffff880211a175b0
[  614.610013]  0000000000000000 0000000000000000 0000000000000000 0000000000000000
[  614.610013]  ffff880211a176c0 0000000000000000 0000000000000000 0000000000000000
[  614.610013] Call Trace:
[  614.610013]  [<ffffffff8121d110>] ? ext4_mb_release_group_pa+0x40/0xfe
[  614.610013]  [<ffffffff8121d110>] ext4_mb_release_group_pa+0x40/0xfe
[  614.610013]  [<ffffffff8121fbe3>] ext4_mb_discard_group_preallocations+0x355/0x3eb
[  614.610013]  [<ffffffff81222b32>] ext4_mb_new_blocks+0x2fd/0x422
[  614.610013]  [<ffffffff8121a495>] ext4_ext_map_blocks+0x146f/0x1969
[  614.610013]  [<ffffffff81404010>] ? radix_tree_gang_lookup_tag_slot+0x81/0xa2
[  614.610013]  [<ffffffff811f5f5f>] ? ext4_map_blocks+0x47/0x221
[  614.610013]  [<ffffffff811f601b>] ? ext4_map_blocks+0x103/0x221
[  614.610013]  [<ffffffff811f604c>] ext4_map_blocks+0x134/0x221
[  614.610013]  [<ffffffff811f9857>] mpage_da_map_and_submit+0xef/0x404
[  614.610013]  [<ffffffff811fa2cc>] ext4_da_writepages+0x350/0x505
[  614.610013]  [<ffffffff811137b4>] do_writepages+0x24/0x2d
[  614.610013]  [<ffffffff811786a5>] writeback_single_inode+0x126/0x2b4
[  614.610013]  [<ffffffff81178f03>] writeback_sb_inodes+0x17f/0x229
[  614.610013]  [<ffffffff81179657>] wb_writeback+0x130/0x23a
[  614.610013]  [<ffffffff81179982>] wb_do_writeback+0x8f/0x1b7
[  614.610013]  [<ffffffff81179b5d>] ? bdi_writeback_thread+0xb3/0x215
[  614.610013]  [<ffffffff81179b36>] bdi_writeback_thread+0x8c/0x215
[  614.610013]  [<ffffffff81179aaa>] ? wb_do_writeback+0x1b7/0x1b7
[  614.610013]  [<ffffffff8109db30>] kthread+0x8e/0x96
[  614.610013]  [<ffffffff819ec584>] kernel_thread_helper+0x4/0x10
[  614.610013]  [<ffffffff819e3974>] ? retint_restore_args+0x13/0x13
[  614.610013]  [<ffffffff8109daa2>] ? __init_kthread_worker+0x5b/0x5b
[  614.610013]  [<ffffffff819ec580>] ? gs_change+0x13/0x13
[  614.610013] Code: 89 c2 4c 89 85 38 ff ff ff 48 8d 4d ec 41 0f b7 74 24 48 e8 ed 06 7e 00 4c 8b 85 38 ff ff ff 48 85 c0 74 50 48 8b 93 a0 00 00 00 <48> 8b 52 28 8b 52 10 89 50 0c 48 8b 93 80 00 00 00 48 89 50 10
[  614.610013] RIP  [<ffffffff81208933>] perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  614.610013]  RSP <ffff880211a17590>
[  614.610013] CR2: 0000000000000028
[  614.615263] ---[ end trace af3c59e20d0fb448 ]---
[  614.615266] ------------[ cut here ]------------
[  614.615271] WARNING: at /c/wfg/linux/kernel/exit.c:898 do_exit+0x67/0x76e()
[  614.615272] Hardware name: X7DW3
[  614.615273] Modules linked in:
[  614.615276] Pid: 4117, comm: flush-8:160 Tainted: G      D W    3.2.0 #313
[  614.615278] Call Trace:
[  614.615282]  [<ffffffff8107dca4>] warn_slowpath_common+0x85/0x9d
[  614.615285]  [<ffffffff8107f42e>] ? kmsg_dump+0x8a/0x10c
[  614.615287]  [<ffffffff8107dcd6>] warn_slowpath_null+0x1a/0x1c
[  614.615289]  [<ffffffff81081417>] do_exit+0x67/0x76e
[  614.615292]  [<ffffffff8107f49f>] ? kmsg_dump+0xfb/0x10c
[  614.615294]  [<ffffffff8107f42e>] ? kmsg_dump+0x8a/0x10c
[  614.615298]  [<ffffffff819e4629>] oops_end+0xbe/0xc6
[  614.615302]  [<ffffffff81056e15>] no_context+0x184/0x193
[  614.615305]  [<ffffffff81056fed>] __bad_area_nosemaphore+0x1c9/0x1e9
[  614.615307]  [<ffffffff81057020>] bad_area_nosemaphore+0x13/0x15
[  614.615310]  [<ffffffff819e69e7>] do_page_fault+0x213/0x431
[  614.615314]  [<ffffffff8110833a>] ? perf_output_copy+0x74/0x74
[  614.615318]  [<ffffffff8140a92d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[  614.615321]  [<ffffffff8121fba3>] ? ext4_mb_discard_group_preallocations+0x315/0x3eb
[  614.615323]  [<ffffffff819e3b85>] page_fault+0x25/0x30
[  614.615326]  [<ffffffff8121fba3>] ? ext4_mb_discard_group_preallocations+0x315/0x3eb
[  614.615328]  [<ffffffff81208933>] ? perf_trace_ext4_mb_release_group_pa+0x81/0xd6
[  614.615331]  [<ffffffff8121d110>] ? ext4_mb_release_group_pa+0x40/0xfe
[  614.615333]  [<ffffffff8121d110>] ext4_mb_release_group_pa+0x40/0xfe
[  614.615336]  [<ffffffff8121fbe3>] ext4_mb_discard_group_preallocations+0x355/0x3eb
[  614.615339]  [<ffffffff81222b32>] ext4_mb_new_blocks+0x2fd/0x422
[  614.615342]  [<ffffffff8121a495>] ext4_ext_map_blocks+0x146f/0x1969
[  614.615346]  [<ffffffff81404010>] ? radix_tree_gang_lookup_tag_slot+0x81/0xa2
[  614.615348]  [<ffffffff811f5f5f>] ? ext4_map_blocks+0x47/0x221
[  614.615350]  [<ffffffff811f601b>] ? ext4_map_blocks+0x103/0x221
[  614.615353]  [<ffffffff811f604c>] ext4_map_blocks+0x134/0x221
[  614.615355]  [<ffffffff811f9857>] mpage_da_map_and_submit+0xef/0x404
[  614.615358]  [<ffffffff811fa2cc>] ext4_da_writepages+0x350/0x505
[  614.615361]  [<ffffffff811137b4>] do_writepages+0x24/0x2d
[  614.615364]  [<ffffffff811786a5>] writeback_single_inode+0x126/0x2b4
[  614.615366]  [<ffffffff81178f03>] writeback_sb_inodes+0x17f/0x229
[  614.615369]  [<ffffffff81179657>] wb_writeback+0x130/0x23a
[  614.615372]  [<ffffffff81179982>] wb_do_writeback+0x8f/0x1b7
[  614.615374]  [<ffffffff81179b5d>] ? bdi_writeback_thread+0xb3/0x215
[  614.615377]  [<ffffffff81179b36>] bdi_writeback_thread+0x8c/0x215
[  614.615379]  [<ffffffff81179aaa>] ? wb_do_writeback+0x1b7/0x1b7
[  614.615382]  [<ffffffff8109db30>] kthread+0x8e/0x96
[  614.615385]  [<ffffffff819ec584>] kernel_thread_helper+0x4/0x10
[  614.615388]  [<ffffffff819e3974>] ? retint_restore_args+0x13/0x13
[  614.615391]  [<ffffffff8109daa2>] ? __init_kthread_worker+0x5b/0x5b
[  614.615393]  [<ffffffff819ec580>] ? gs_change+0x13/0x13
[  614.615395] ---[ end trace af3c59e20d0fb449 ]---
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists