linux-kernel - bio pages with zero page reference count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061218222109.GA23156@coraid.com>
Date:	Mon, 18 Dec 2006 17:21:09 -0500
From:	"Ed L. Cashin" <ecashin@...aid.com>
To:	linux-kernel@...r.kernel.org
Cc:	Greg KH <greg@...ah.com>, boddingt@...usnet.com.au,
	Andrew Morton <akpm@...l.org>,
	bugme-daemon@...zilla.kernel.org,
	Christoph Hellwig <hch@...radead.org>
Subject: bio pages with zero page reference count

(This email is a followup to "Re: [PATCH 2.6.19.1] fix aoe without
scatter-gather [Bug 7662]".)

On Mon, Dec 18, 2006 at 12:53:00PM -0500, Ed L. Cashin wrote:
...
> This patch eliminates the offset data on cards that don't support
> scatter-gather or have had scatter-gather turned off.  There remains
> an unrelated issue that I'll address in a separate email.

After fixing the problem with the skb headers, we noticed that there
were still problems when scatter gather wasn't in use.  XFS was giving
us bios that had pages with a reference count of zero.

The aoe driver sets up the skb with the frags pointing to the pages,
and when scatter gather isn't supported and __pskb_pull_tail gets
involved, put_page is called after the data is copied from the pages.
That causes problems because of the zero page reference count.

It seems like it would always be incorrect for one part of the kernel
to give pages with a zero reference count to another part of the
kernel, so this seems like a bug in XFS.

Christoph Hellwig, though, points out,

  > It's a kmalloced page.  The same can happen with ext3 aswell, but
  > only when doing log recovery.  The last time this came up (vs
  > iscsi) the conclusion was that the driver needs to handle this
  > case.

In attempting to find the conversation he was referencing, I only
found this:

  Subject: tcp_sendpage and page allocation lifetime vs. iscsi
  Date: 2005-04-25 17:02:59 GMT
  http://article.gmane.org/gmane.linux.kernel/298377

If anyone has a better reference, I'd like to see it.

-- 
  Ed L Cashin <ecashin@...aid.com>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/