linux-kernel - Re: [RFC PATCH] virtio_blk: Checking "private_data" to avoid kernel panic when hotplugging

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120411083608.GC8562@redhat.com>
Date:	Wed, 11 Apr 2012 11:36:08 +0300
From:	"Michael S. Tsirkin" <mst@...hat.com>
To:	Ren Mingxin <renmx@...fujitsu.com>
Cc:	Rusty Russell <rusty@...tcorp.com.au>,
	Kay Sievers <kay.sievers@...y.org>,
	Tokunaga Kei <tokunaga.keiich@...fujitsu.com>,
	LKML <linux-kernel@...r.kernel.org>,
	UDEV <linux-hotplug@...r.kernel.org>
Subject: Re: [RFC PATCH] virtio_blk: Checking "private_data"  to avoid kernel
 panic when hotplugging

On Wed, Apr 11, 2012 at 11:17:16AM +0800, Ren Mingxin wrote:
>  On 04/09/2012 03:53 PM, Michael S. Tsirkin wrote:
> >On Wed, Mar 28, 2012 at 11:40:33AM +0800, Ren Mingxin wrote:
> >>On guest with upstream's kernel(3.3.0-rc7), I
> >>mounted virtblk as:
> >>   a) # mkfs /dev/vda
> >>   b) # mount /dev/vda /mnt
> >>   c) # cd /mnt
> >>
> >>Then I did hotplug for virtblk via virsh on host as:
> >>   a) # sudo virsh detach-disk guest vda
> >>   b) # sudo virsh attach-disk guest /media/data/test.img vda
> >>
> >>I encountered guest's kernel panic (*probability*
> >>*event*)whose backtrace liked this:
> >Any news here? Managed to trace?
> 
> Sorry, I had a leave last week.
> 
> >Does this still happen with 3.4-rc2?
> 
> I retested this with 3.4-rc2, but the panic couldn't be reproduced.
> (Last time, It seemed that the upstream's kernel was 3.3-rc7)
> 
> >There's a chance you are hitting a race fixed by
> >4678d6f970c2f7c0cbfefc0cc666432d153b321b.
> >
> >If it's still not fixed it might make sense to enable slab debugging -
> >we might have a use after free here.
> >
> 
> I don't think the below commit has fixed this panic issue, for it is
> included
> in my last test environment(3.3-rc7).
> 4678d6f970c2f7c0cbfefc0cc666432d153b321b
> 
> Now, I'd find which commit makes sense.

Great, thanks very much. I do suggest slab debugging if
the race reproduces for you with it enabled - reducing
the chance random struct rearrangements hide the bug.

> -- 
> Thanks,
> Ren
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/