| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <5288DAD0.5020306@gmx.de>
Date: Sun, 17 Nov 2013 16:03:44 +0100
From: Toralf Förster <toralf.foerster@....de>
To: Richard Weinberger <richard@....at>
CC: Konstantin Khlebnikov <koct9i@...il.com>,
Linux Kernel <linux-kernel@...r.kernel.org>,
linux-fsdevel <linux-fsdevel@...r.kernel.org>,
"linux-mm@...ck.org" <linux-mm@...ck.org>,
UML devel <user-mode-linux-devel@...ts.sourceforge.net>
Subject: Re: [uml-devel] fuzz tested 32 bit user mode linux image hangs in
radix_tree_next_chunk()
On 11/06/2013 10:31 PM, Richard Weinberger wrote:
> Am 06.11.2013 22:18, schrieb Toralf Förster:
>> On 11/06/2013 05:06 PM, Konstantin Khlebnikov wrote:
>>> In this case it must stop after scanning whole tree in line:
>>> /* Overflow after ~0UL */
>>> if (!index)
>>> return NULL;
>>>
>>
>> A fresh current example with latest git tree shows that lines 769 and 770 do alternate :
>
> Can you please ask gdb for the value of offset?
>
> Thanks,
> //richard
>
In the mean while I think that it is not the radix-tree itself where the hang is related to. With this patch :
diff --git a/mm/truncate.c b/mm/truncate.c
index 353b683..22a5926 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -355,6 +355,8 @@ EXPORT_SYMBOL(truncate_inode_pages_range);
*/
void truncate_inode_pages(struct address_space *mapping, loff_t lstart)
{
+ if (lstart > 0)
+ printk ("lstart=%lld\n", lstart);
truncate_inode_pages_range(mapping, lstart, (loff_t)-1);
}
EXPORT_SYMBOL(truncate_inode_pages);
against v3.12-10087-g1213959 I get in the syslog entires like :
Nov 17 14:07:12 trinity tfoerste: M=/mnt/nfsv4
Nov 17 14:07:27 trinity kernel: lstart=2147418111
Nov 17 14:07:30 trinity kernel: lstart=14531581
Nov 17 14:07:30 trinity kernel: lstart=8388607
Nov 17 14:07:30 trinity kernel: lstart=187
Nov 17 14:07:32 trinity kernel: lstart=2048
Nov 17 14:08:00 trinity kernel: lstart=11264
Nov 17 14:08:00 trinity kernel: lstart=44297
Nov 17 14:08:05 trinity kernel: lstart=31
Nov 17 14:08:34 trinity kernel: lstart=1542
Nov 17 14:08:35 trinity kernel: lstart=30
Nov 17 14:08:35 trinity kernel: lstart=2088809
Nov 17 14:08:37 trinity kernel: lstart=208
Nov 17 14:08:37 trinity kernel: lstart=7276806
Nov 17 14:08:37 trinity kernel: lstart=191
...
Nov 17 14:11:22 trinity tfoerste: M=/mnt/nfsv4
Nov 17 14:11:36 trinity kernel: lstart=255
Nov 17 14:11:36 trinity kernel: lstart=500676444
Nov 17 14:11:37 trinity kernel: lstart=1024
Nov 17 14:11:37 trinity kernel: lstart=12786775
Nov 17 14:11:37 trinity kernel: lstart=16728385
Nov 17 14:11:37 trinity kernel: lstart=44
Nov 17 14:11:37 trinity kernel: lstart=516
Nov 17 14:11:38 trinity kernel: lstart=17407
Nov 17 14:11:38 trinity kernel: lstart=31
Nov 17 14:11:38 trinity kernel: lstart=65534
Nov 17 14:11:39 trinity kernel: lstart=4302304271
Nov 17 14:11:40 trinity kernel: lstart=65536
Nov 17 14:11:40 trinity kernel: lstart=678625087
Nov 17 14:11:40 trinity kernel: lstart=190464262
Nov 17 14:11:41 trinity kernel: lstart=268435343
Nov 17 14:11:42 trinity kernel: lstart=109
Nov 17 14:11:42 trinity kernel: lstart=2088960
Nov 17 14:11:42 trinity kernel: lstart=989582838
Nov 17 14:11:42 trinity kernel: lstart=3838
Nov 17 14:11:42 trinity kernel: lstart=327
Nov 17 14:11:43 trinity kernel: lstart=119
Nov 17 14:12:14 trinity kernel: lstart=9949
Nov 17 14:12:14 trinity kernel: lstart=4096
Nov 17 14:12:15 trinity kernel: lstart=3
Nov 17 14:12:18 trinity sshd[9636]: pam_unix(sshd:session): session closed for user tfoerste
...
Does this helps ?
>>
>> tfoerste@n22 ~/devel/linux $ sudo gdb /usr/local/bin/linux-v3.12-48-gbe408cd 16619 -n -batch -ex bt
>> 0x08296a8c in radix_tree_next_chunk (root=0x25, iter=0x462e7c64, flags=12) at lib/radix-tree.c:770
>> 770 if (node->slots[offset])
>> #0 0x08296a8c in radix_tree_next_chunk (root=0x25, iter=0x462e7c64, flags=12) at lib/radix-tree.c:770
>> #1 0x080cc1fe in find_get_pages (mapping=0x462ad470, start=0, nr_pages=14, pages=0xc) at mm/filemap.c:844
>> #2 0x080d5d6a in pagevec_lookup (pvec=0x462e7cc8, mapping=0x25, start=37, nr_pages=37) at mm/swap.c:914
>> #3 0x080d615a in truncate_inode_pages_range (mapping=0x462ad470, lstart=0, lend=-1) at mm/truncate.c:241
>> #4 0x080d64ff in truncate_inode_pages (mapping=0x25, lstart=51539607589) at mm/truncate.c:358
>>
>>
>>
>>
>> tfoerste@n22 ~/devel/linux $ sudo gdb /usr/local/bin/linux-v3.12-48-gbe408cd 16619 -n -batch -ex bt
>> radix_tree_next_chunk (root=0x28, iter=0x462e7c64, flags=18) at lib/radix-tree.c:769
>> 769 while (++offset < RADIX_TREE_MAP_SIZE) {
>> #0 radix_tree_next_chunk (root=0x28, iter=0x462e7c64, flags=18) at lib/radix-tree.c:769
>> #1 0x080cc1fe in find_get_pages (mapping=0x462ad470, start=0, nr_pages=14, pages=0x12) at mm/filemap.c:844
>> #2 0x080d5d6a in pagevec_lookup (pvec=0x462e7cc8, mapping=0x28, start=40, nr_pages=40) at mm/swap.c:914
>> #3 0x080d615a in truncate_inode_pages_range (mapping=0x462ad470, lstart=0, lend=-1) at mm/truncate.c:241
>> #4 0x080d64ff in truncate_inode_pages (mapping=0x28, lstart=77309411368) at mm/truncate.c:358
>> #5 0x0825e388 in hostfs_evict_inode (inode=0x462ad3b8) at fs/hostfs/hostfs_kern.c:242
>> #6 0x0811a8df in evict (inode=0x462ad3b8) at fs/inode.c:549
>>
>>
>
>
--
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists