linux-kernel - Re: Panic in reserve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100224214355.GA16431@linux-os.sc.intel.com>
Date:	Wed, 24 Feb 2010 13:43:55 -0800
From:	"Pallipadi, Venkatesh" <venkatesh.pallipadi@...el.com>
To:	Jack Steiner <steiner@....com>
Cc:	"Pallipadi, Venkatesh" <venkatesh.pallipadi@...el.com>,
	"Siddha, Suresh B" <suresh.b.siddha@...el.com>,
	"mingo@...e.hu" <mingo@...e.hu>,
	"tglx@...utronix.de" <tglx@...utronix.de>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Panic in reserve_memtype()

On Wed, Feb 24, 2010 at 01:37:29PM -0800, Jack Steiner wrote:
> On Wed, Feb 24, 2010 at 01:09:24PM -0800, Pallipadi, Venkatesh wrote:
> > 
> > On Wed, 2010-02-24 at 12:22 -0800, Jack Steiner wrote:
> > > We see an X86_64 regression that started a few days ago. The kernel is booted
> > > via EFI & panics in the pat.c code trying to deref a NULL pointer.
> > > 
> > > I didn't debug the problem but am suspicious of
> > > 	x86, pat: Migrate to rbtree only backend for pat memtype management  x86/pat
> > > 		author	Pallipadi, Venkatesh <venkatesh.pallipadi@...el.com>	
> > > 		Wed, 10 Feb 2010 23:26:07 +0000 (15:26 -0800)
> > > 	committer	H. Peter Anvin <hpa@...or.com>	
> > > 		Thu, 18 Feb 2010 23:41:36 +0000 (15:41 -0800)
> > > 
> > > 
> > > 
> > > Has anyone seen this? If not, I can debug further....
> > > 
> > 
> > 
> > Haven't seen this on my test systems here, but I haven't tested with EFI
> > boot either.
> > 
> > I assume this is repeatable, and you always see this panic. I am looking
> > at the code right now. Can you rollback this particular patch and see
> > whether it goes away?
> 
> The problem is very repeatible.
> 
> FWIW, we have a nightly regression test that builds/tests the x86 tree
> everynight at 1 AM. The failure started on the morning of Feb 22.
> 
> The build on Feb 21 (& all of Feb before then) passed w/o errors.
> I can't rule out other errors but I don't see anything else that changed.
> 
> The linux-next tree appears to have the same problem.
> 

I guess I found an obvious problem in the code. Can you check whether the
below patch resolves the panic you are seeing.

Thanks,
Venki


new->type should only change when there is a valid ret_type. Otherwise
requested type and return type should be same.

Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@...el.com>
---
 arch/x86/mm/pat_rbtree.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index e4cd229..58b6de1 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -223,7 +223,9 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
 						new->type, ret_type);
 
 	if (!err) {
-		new->type = *ret_type;
+		if (ret_type)
+			new->type = *ret_type;
+
 		memtype_rb_insert(&memtype_rbroot, new);
 	}
 	return err;
-- 
1.6.0.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/