linux-kernel - Re: ext4 crash on 2.6.37: NULL ptr in ext4_discard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 20 Feb 2011 08:55:46 -0500
From:	Mark Lord <kernel@...savvy.com>
To:	Ted Ts'o <tytso@....edu>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	linux-ext4@...r.kernel.org
Subject: Re: ext4 crash on 2.6.37: NULL ptr in ext4_discard_preallocations

On 11-02-20 01:15 AM, Ted Ts'o wrote:
> On Sun, Feb 20, 2011 at 12:05:27AM -0500, Mark Lord wrote:
>> I suppose it must be, as there's no other 0x3c offset in that function.
>> Which means it's probably this line that's crashing:
>>
>>              BUG_ON(pa->pa_obj_lock != &ei->i_prealloc_lock);
>>
>> ...which could only happen if "pa" was NULL there.
>> I wonder how that happened ?
> 
> Which could only happen if ei->i_prealloc_list were not properly
> initialized (i..e, it was still NULL).  Which shouldn't ever
> happen...., since all ext4_inodes are initialized in
> ext4_alloc_inode().
> 
> Hmm, can you replicate the crash?

So far it has been a one time deal here,
but stuff like this is pretty serious nonetheless.

I suppose it could also happen if another thread did a list-delete
at the same time as that function was running.  Which would require
that there be a locking bug/confusion somewhere.

Looking over the code, most places use rcu to protect accesses,
except for the fragment that crashed.  That's probably just fine,
but something to reexamine just out of paranoia.

Also, the spinlock pointer appears to be dynamic, one of two
possible spinlocks.  Maybe something got confused there
(well, obviously *something* got confused, so..).

Tough nut to crack, but if I saw strangeness like this again
I'd get really concerned about the state of our top grade filesystems
(had an XFS crash recently on a totally different machine).

I'll poke a bit more, looking specifically at recent ext4 changes.

Thanks Ted.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/