lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Oct 2007 23:50:10 -0700 (PDT) From: David Miller <davem@...emloft.net> To: jens.axboe@...cle.com CC: fujita.tomonori@....ntt.co.jp, linux-kernel@...r.kernel.org Subject: IDE crash... I'm debugging a blk_rq_map_sg() crash that i'm getting on sparc64 as root is mounted over IDE. I think I know what is happening now. The IDE sg table is allocated and initialized like this in drivers/ide/ide-probe.c: x = kmalloc(sizeof(struct scatterlist) * nents, GFP_XXX); sg_init_table(x, nents); So far, so good. Now, ide_map_sg() passes requests down to blk_rq_map_sg() like this in drivers/block/ide-io.c: hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg); Ok, so what does blk_rq_map_sg() do? sg = NULL; rq_for_each_segment(bvec, rq, iter) { ... if (bvprv && cluster) { ... } else { new_segment: if (!sg) sg = sglist; else sg = sg_next(sg); ... } bvprv = bvec; } /* segments in rq */ if (sg) __sg_mark_end(sg); So let's say the first request comes in and needs 2 segs. This will mark sg[1].page_link with 0x2 If the next request from IDE needs 4 segs, we'll OOPS because sg_next() on &sg[1] will see page_link bit 0x2 is set and therefore return NULL. A quick look shows that if you're testing on SCSI (or something layered on top of it like SATA or PATA) you won't see this seemingly guarenteed crash because the SCSI mid-layer allocates a fresh sglist via mempool_alloc() and runs sg_init_table() on it for every I/O request. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists