linux-kernel - Re: XFS Bug null pointer dereference in xfs_free_ag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060731195354.B2301615@wobbly.melbourne.sgi.com>
Date:	Mon, 31 Jul 2006 19:53:54 +1000
From:	Nathan Scott <nathans@....com>
To:	Joe Jin <lkmaillist@...il.com>
Cc:	kernel <linux@...center.cn>, jdi@....org,
	linux-kernel@...r.kernel.org, rdunlap@...otime.net,
	wim.coekaerts@...cle.com
Subject: Re: XFS Bug null pointer dereference in xfs_free_ag_extent

On Mon, Jul 31, 2006 at 04:41:28PM +0800, Joe Jin wrote:
> At XFS have a debug option, but I wonder why why it was not opened,
> and you may open the option with follow patch, rebuild kernel, you
> maybe get more information of it.
> And when I trace the code, I also found at some function should check
> the return value, it also include the patch.

Hmmm.  If you want to enable debug, theres an "official" patch in
the XFS CVS tree for doing so ... this patch has one or two minor
issues:

+config XFS_DEBUG
+	bool "XFS debugging"
+	depends on XFS_FS
+	help
+	  If you are experiencing any problems with the XFS filesystem, say
+	  Y here.  This will result in additional debugging messages to be
+	  written to the system log.

Thats not really what it does - it actually mostly enables asserts
all over the code, which cause the system to panic if something bad
is detected.

I don't expect the XFS debug code to help in this particular situation
in fact it may well hide the problem.

+  Under normal circumstances, this
+	  results in very little overhead.

Its actually quite expensive.  This is one of the reasons the enabling
patch isn't in mainline, as people switch it on and wonder what happened
to their performance numbers (also it is more useful with kdb).

 	cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_SLEEP);
+	if(!cur)
+		return NULL;

This can never happen due to the alloc flags argument.

--- linux-2.6.18-rc3/fs/xfs/xfs_alloc.c	2006-07-30 14:15:36.000000000 +0800
+++ linux.new/fs/xfs/xfs_alloc.c	2006-07-31 16:09:04.000000000 +0800
@@ -649,6 +649,9 @@
 	 */
 	bno_cur = xfs_btree_init_cursor(args->mp, args->tp, args->agbp,
 		args->agno, XFS_BTNUM_BNO, NULL, 0);
+	if(!bno_cur)
+		return XFS_ERROR(ENOMEM);

This also should never happen.  From my reading of the oops report,
the problem is inside xfs_btree_init_cursor, I think from one of the
buffer pointers being null when it shouldn't be, but I'd like to get
it reproduced locally to be sure.

cheers.

-- 
Nathan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/