[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4A30A25F.1080503@us.ibm.com>
Date: Wed, 10 Jun 2009 23:21:19 -0700
From: Darren Hart <dvhltc@...ibm.com>
To: Peter Zijlstra <peterz@...radead.org>
CC: "Zhang, Yanmin" <yanmin_zhang@...ux.intel.com>,
Rusty Russell <rusty@...tcorp.com.au>,
LKML <linux-kernel@...r.kernel.org>,
Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Bug: fio traps into kernel without exiting because futex has
a deadloop
Peter Zijlstra wrote:
> On Thu, 2009-06-11 at 07:55 +0200, Peter Zijlstra wrote:
>> On Thu, 2009-06-11 at 11:08 +0800, Zhang, Yanmin wrote:
>>> I investigate a fio hang issue. When I run fio multi-process
>>> testing on many disks, fio traps into kernel and doesn't exit
>>> (mostly hit once after runing sub test cases for hundreds of times).
>>>
>>> Oprofile data shows kernel consumes time with some futex functions.
>>> Command kill couldn't kill the process and machine reboot also hangs.
>>>
>>> Eventually, I locate the root cause as a bug of futex. Kernel enters
>>> a deadloop between 'retry' and 'goto retry' in function futex_wake_op.
>>> By unknown reason (might be an issue of fio or glibc), parameter uaddr2
>>> points to an area which is READONLY. So futex_atomic_op_inuser returns
>>> -EFAULT when trying to changing the data at uaddr2, but later get_user
>>> still succeeds becasue the area is READONLY. Then go back to retry.
>>>
>>> I create a simple test case to trigger it, which just shmat an READONLY
>>> area for address uaddr2.
>>>
>>> It could be used as a DOS attack.
>
> /me has morning juice and notices he sent the wrong commit...
>
> commit 64d1304a64477629cb16b75491a77bafe6f86963
> Author: Thomas Gleixner <tglx@...utronix.de>
> Date: Mon May 18 21:20:10 2009 +0200
>
> futex: setup writeable mapping for futex ops which modify user space data
Yup, that's the one. I was trying to locate it myself, but you beat me
to it. Thanks Peter.
--
Darren Hart
IBM Linux Technology Center
Real-Time Linux Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists