| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1865303E0DED764181A9D882DEF65FB685AF8B6D57@shsmsx502.ccr.corp.intel.com>
Date: Fri, 7 Jan 2011 12:14:39 +0800
From: "Zhong, Xin" <xin.zhong@...el.com>
To: Andrew Morton <akpm@...ux-foundation.org>,
"StMichalke@....de" <StMichalke@....de>
CC: "bugzilla-daemon@...zilla.kernel.org"
<bugzilla-daemon@...zilla.kernel.org>,
Peter Zijlstra <a.p.zijlstra@...llo.nl>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-btrfs@...r.kernel.org" <linux-btrfs@...r.kernel.org>
Subject: RE: [Bug 26242] New: BUG: unable to handle kernel NULL pointer
dereference at (null)
A similar bug has been reported by Kenneth Lakin [kennethlakin@...il.com] last week. It's related to my check-in (git commit 914ee295af418e936ec20a08c1663eaabe4cd07a). I am looking into it now.
I found one suspicious code in prepage_pages (fs/btrfs/file.c):
start_pos = pos & ~((u64)root->sectorsize - 1);
last_pos = ((u64)index + num_pages) << PAGE_CACHE_SHIFT;
root->sectorsize is used at first, but PAGE_SIZE is used after it. Do we assume these two values are always the same?
-----Original Message-----
From: linux-btrfs-owner@...r.kernel.org [mailto:linux-btrfs-owner@...r.kernel.org] On Behalf Of Andrew Morton
Sent: Friday, January 07, 2011 5:13 AM
To: StMichalke@....de
Cc: bugzilla-daemon@...zilla.kernel.org; Peter Zijlstra; linux-kernel@...r.kernel.org; linux-btrfs@...r.kernel.org
Subject: Re: [Bug 26242] New: BUG: unable to handle kernel NULL pointer dereference at (null)
(switched to email. Please respond via emailed reply-to-all, not via the
bugzilla web interface).
On Thu, 6 Jan 2011 20:59:08 GMT
bugzilla-daemon@...zilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=26242
>
> Summary: BUG: unable to handle kernel NULL pointer dereference
> at (null)
> Product: Memory Management
> Version: 2.5
> Kernel Version: 2.6.37
> Platform: All
> OS/Version: Linux
> Tree: Mainline
> Status: NEW
> Severity: low
> Priority: P1
> Component: Other
> AssignedTo: akpm@...ux-foundation.org
> ReportedBy: StMichalke@....de
> Regression: No
>
>
> My system crashed with the following output:
>
> ___
> Jan 6 20:06:22 eser kernel: [19365.562621] BUG: unable to handle kernel NULL
> pointer dereference at (null)
> Jan 6 20:06:22 eser kernel: [19365.562675] IP: [<c022989b>]
> kmap_atomic_prot+0x1b/0x100
> Jan 6 20:06:22 eser kernel: [19365.562709] *pde = 00000000
> Jan 6 20:06:22 eser kernel: [19365.562726] Oops: 0000 [#1] PREEMPT SMP
> Jan 6 20:06:22 eser kernel: [19365.562752] last sysfs file:
> /sys/devices/platform/coretemp.0/temp1_input
> Jan 6 20:06:22 eser kernel: [19365.562777] Modules linked in: isofs usblp
> usb_storage uas nls_utf8 udf crc_itu_t fuse ipt_MASQUERADE xt_pkttype xt_TCPMSS
> xt_tcpudp ipt_LOG xt_limit iptable_nat nf_nat snd_pcm_oss snd_mixer_oss snd_seq
> snd_seq_device xt_NOTRACK ipt_REJECT xt_state iptable_raw iptable_filter
> nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 ip_tables
> cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf
> speedstep_lib ip6_tables x_tables loop arc4 ecb b43 snd_hda_codec_si3054
> mac80211 snd_hda_codec_realtek snd_hda_intel r8169 snd_hda_codec cfg80211
> sdhci_pci mii snd_hwdep acer_wmi sdhci snd_pcm rfkill iTCO_wdt yenta_socket ssb
> tifm_7xx1 iTCO_vendor_support sg sr_mod mmc_core snd_timer pcmcia_core
> tifm_core cdrom pcspkr wmi pcmcia_rsrc psmouse snd i2c_i801 shpchp evdev
> soundcore battery rng_core ac snd_page_alloc pci_hotplug dm_crypt usbhid hid
> nouveau ttm drm_kms_helper drm uhci_hcd rtc_cmos ata_piix i2c_algo_bit i2c_core
> rtc_core cfbcopyarea ehci_hcd usb
> Jan 6 20:06:22 eser kernel: core video cfbimgblt cfbfillrect rtc_lib output
> button nls_base dm_snapshot sha512_generic sha256_generic xts cbc aes_i586
> aes_generic cfq_iosched blk_cgroup btrfs zlib_deflate libcrc32c reiserfs ahci
> libahci libata coretemp hwmon fan thermal processor unix [last unloaded:
> pktcdvd]
> Jan 6 20:06:22 eser kernel: [19365.563014]
> Jan 6 20:06:22 eser kernel: [19365.563014] Pid: 15675, comm: gimp-2.6 Not
> tainted 2.6.37 #1 Myall2 /Aspire 9410
> Jan 6 20:06:22 eser kernel: [19365.563014] EIP: 0060:[<c022989b>] EFLAGS:
> 00010202 CPU: 0
> Jan 6 20:06:22 eser kernel: [19365.563014] EIP is at
> kmap_atomic_prot+0x1b/0x100
> Jan 6 20:06:22 eser kernel: [19365.563014] EAX: 00000000 EBX: 00000600 ECX:
> f3a82000 EDX: 00000163
> Jan 6 20:06:23 eser kernel: [19365.563014] ESI: f3a83eac EDI: 00000000 EBP:
> f3a83db8 ESP: f3a83da8
> Jan 6 20:06:23 eser kernel: [19365.563014] DS: 007b ES: 007b FS: 00d8 GS:
> 0033 SS: 0068
> Jan 6 20:06:23 eser kernel: [19365.563014] Process gimp-2.6 (pid: 15675,
> ti=f3a82000 task=eaf28000 task.ti=f3a82000)
> Jan 6 20:06:23 eser kernel: [19365.563014] Stack:
> Jan 6 20:06:23 eser kernel: [19365.563014] f3a83dc0 00000600 f3a83eac
> 00000000 f3a83dc0 c022998e f3a83dd8 c0299c0c
> Jan 6 20:06:23 eser kernel: [19365.563014] e0359240 00000600 00001000
> 00001000 f3a83dfc f828d6da 00000600 00001008
> Jan 6 20:06:23 eser kernel: [19365.563014] 00000002 00000000 00000002
> 00002000 00001608 f3a83ed0 f828e1ff 00001608
> Jan 6 20:06:23 eser kernel: [19365.563014] Call Trace:
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c022998e>] ?
> __kmap_atomic+0xe/0x10
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c0299c0c>] ?
> iov_iter_copy_from_user_atomic+0x3c/0x90
> Jan 6 20:06:23 eser kernel: [19365.563014] [<f828d6da>] ?
> btrfs_copy_from_user+0x5a/0xb0 [btrfs]
> Jan 6 20:06:23 eser kernel: [19365.563014] [<f828e1ff>] ?
> btrfs_file_aio_write+0x52f/0x9c0 [btrfs]
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d0810>] ?
> __mem_cgroup_commit_charge+0x70/0xe0
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d672c>] ?
> do_sync_write+0x9c/0xd0
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d6b15>] ?
> rw_verify_area+0x65/0x100
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d6e7a>] ?
> vfs_write+0x9a/0x160
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d8211>] ?
> fget_light+0x91/0xb0
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d6690>] ?
> do_sync_write+0x0/0xd0
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d714d>] ? sys_write+0x3d/0x70
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c0202e18>] ?
> sysenter_do_call+0x12/0x28
> Jan 6 20:06:23 eser kernel: [19365.563014] [<c04e0000>] ?
> quirk_amd_ide_mode+0x40/0x95
> Jan 6 20:06:23 eser kernel: [19365.563014] Code: 8b 15 4c 6a 6b c0 55 89 e5 e8
> e2 f8 ff ff 5d c3 55 89 e5 83 ec 10 89 e1 81 e1 00 e0 ff ff 89 5d f4 89 75 f8
> 89 7d fc 83 41 14 01 <8b> 08 c1 e9 1e 69 d9 40 03 00 00 8d 8b c0 42 64 c0 2b 8b
> cc 45
> Jan 6 20:06:23 eser kernel: [19365.563014] EIP: [<c022989b>]
> kmap_atomic_prot+0x1b/0x100 SS:ESP 0068:f3a83da8
> Jan 6 20:06:23 eser kernel: [19365.563014] CR2: 0000000000000000
> Jan 6 20:06:23 eser kernel: [19365.568714] ---[ end trace afc2be06c7d06a71
> ]---
> Jan 6 20:06:23 eser kernel: [19365.568724] note: gimp-2.6[15675] exited with
> preempt_count 2
> ___
>
> The kernel is an unpatched v2.6.37. I have not seen something like this before.
Bugzilla's habit of wordwrapping oops traces is fantastically
irritating. Please use attachments to avoid this.
Either Peter's new kmap_atomic() stuff blew up or BTRFS is playing
around with a NULL page*. I'd wager on the latter.
Thanks, I'll ask Rafael and Maciej to track this as a 2.6.36->2.6.37
regression.
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists