Message-ID: <5554C6B9.9070805@yandex-team.ru>
Date:	Thu, 14 May 2015 19:00:57 +0300
From:	Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
To:	Tony Luck <tony.luck@...el.com>,
	Anton Vorontsov <anton@...msg.org>,
	linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>,
	Colin Cross <ccross@...roid.com>,
	Aruna Balakrishnaiah <aruna@...ux.vnet.ibm.com>
Subject: Re: [PATCH] pstore: do not use message compression without lock

On 21.04.2015 14:32, Konstantin Khlebnikov wrote:
> pstore_compress() uses static stream buffer for zlib-deflate which
> easily crashes when several concurrent threads use one shared state.
>
> Signed-off-by: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
> ---
>   fs/pstore/platform.c |    2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
> index c4c9a10c5760..de525ec0b490 100644
> --- a/fs/pstore/platform.c
> +++ b/fs/pstore/platform.c
> @@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
>   		bool compressed;
>   		size_t total_len;
>
> -		if (big_oops_buf) {
> +		if (big_oops_buf && is_locked) {
>   			dst = big_oops_buf;
>   			hsize = sprintf(dst, "%s#%d Part%u\n", why,
>   							oopscount, part);
>


Bump

Example of crash:

<1>[ 3579.939946] BUG: unable to handle kernel paging request at 
0000000081eea3dc
<1>[ 3579.939951] IP: [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.939953] PGD 0
<4>[ 3579.939954] Oops: 0000 [#1] SMP
<4>[ 3579.939970] Modules linked in: netconsole configfs 8021q mrp garp 
stp llc x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm 
crc32_pclmul ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw 
gf128mul glue_helper aes_x86_64 microcode sb_edac edac_core ipmi_si 
ipmi_msghandler ast ttm drm_kms_helper drm sysimgblt sysfillrect 
syscopyarea lpc_ich mlx4_en mlx4_core vxlan udp_tunnel ip6_udp_tunnel 
tcp_htcp igb dca i2c_algo_bit isci i2c_core ptp libsas ahci pps_core 
scsi_transport_sas libahci raid10 raid456 async_pq async_xor xor 
async_memcpy async_raid6_recov raid6_pq async_tx raid1 raid0 multipath 
linear
<4>[ 3579.939972] CPU: 12 PID: 0 Comm: swapper/12 Tainted: G        W 
    3.18.11-11 #4
<4>[ 3579.939974] task: ffff883fd2e4baa0 ti: ffff881fd31fc000 task.ti: 
ffff881fd31fc000
<4>[ 3579.939976] RIP: 0010:[<ffffffff81382274>]  [<ffffffff81382274>] 
zlib_tr_tally+0xe4/0x130
<4>[ 3579.939976] RSP: 0018:ffff88407fc86ae8  EFLAGS: 00010016
<4>[ 3579.939977] RAX: 000000000000006c RBX: ffff881fd0080000 RCX: 
ffff881fd0087348
<4>[ 3579.939978] RDX: 00000000fffffffc RSI: 000000000000003f RDI: 
ffff881fd0080000
<4>[ 3579.939978] RBP: ffff88407fc86ae8 R08: 000000000000006d R09: 
0000000000000041
<4>[ 3579.939978] R10: ffff881fd0081748 R11: 0000000000000000 R12: 
0000000000000577
<4>[ 3579.939979] R13: 0000000000003ae1 R14: 0000000000000005 R15: 
ffff881fd00700c8
<4>[ 3579.939980] FS:  0000000000000000(0000) GS:ffff88407fc80000(0000) 
knlGS:0000000000000000
<4>[ 3579.939980] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 3579.939981] CR2: 0000000081eea3dc CR3: 0000000001c14000 CR4: 
00000000001407e0
<4>[ 3579.939981] Stack:
<4>[ 3579.939982]  ffff88407fc86b18 ffffffff8137ef38 ffff881fd0080000 
ffffffff81ee4340
<4>[ 3579.939983]  0000000000000005 0000000000000f00 ffff88407fc86b48 
ffffffff8137fa23
<4>[ 3579.939984]  ffff883fcff90000 0000000000000010 0000000000000002 
0000000000000fc1
<4>[ 3579.939985] Call Trace:
<4>[ 3579.939986]  <NMI>
<4>[ 3579.939987]  [<ffffffff8137ef38>] deflate_slow+0x218/0x420
<4>[ 3579.939989]  [<ffffffff8137fa23>] zlib_deflate+0xc3/0x400
<4>[ 3579.939993]  [<ffffffff812de50e>] pstore_dump+0x26e/0x410
<4>[ 3579.939997]  [<ffffffff810b0da7>] kmsg_dump+0x127/0x160
<4>[ 3579.939998]  [<ffffffff810febe2>] watchdog_overflow_callback+0xa2/0xc0
<4>[ 3579.940001]  [<ffffffff8113a3a8>] __perf_event_overflow+0x98/0x230
<4>[ 3579.940004]  [<ffffffff8102c34a>] ? 
x86_perf_event_set_period+0xda/0x150
<4>[ 3579.940005]  [<ffffffff8113ae04>] perf_event_overflow+0x14/0x20
<4>[ 3579.940007]  [<ffffffff810338c9>] intel_pmu_handle_irq+0x1d9/0x3c0
<4>[ 3579.940009]  [<ffffffff81182641>] ? 
unmap_kernel_range_noflush+0x11/0x20
<4>[ 3579.940011]  [<ffffffff813f9768>] ? ghes_copy_tofrom_phys+0x118/0x1f0
<4>[ 3579.940013]  [<ffffffff8102b694>] perf_event_nmi_handler+0x34/0x60
<4>[ 3579.940014]  [<ffffffff81018b9a>] nmi_handle+0x8a/0x150
<4>[ 3579.940016]  [<ffffffff813fa600>] ? 
ghes_print_estatus.constprop.12+0x70/0x70
<4>[ 3579.940017]  [<ffffffff81019266>] default_do_nmi+0x56/0x160
<4>[ 3579.940018]  [<ffffffff81019400>] do_nmi+0x90/0xd0
<4>[ 3579.940020]  [<ffffffff816d34e1>] end_repeat_nmi+0x1e/0x2e
<4>[ 3579.940023]  [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940024]  [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940026]  [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940027]  <<EOE>>
<4>[ 3579.940029]  [<ffffffff81574787>] cpuidle_enter_state+0x57/0x1d0
<4>[ 3579.940030]  [<ffffffff815749c7>] cpuidle_enter+0x17/0x20
<4>[ 3579.940032]  [<ffffffff810a893f>] cpu_startup_entry+0x34f/0x3d0
<4>[ 3579.940034]  [<ffffffff810cd772>] ? 
clockevents_register_device+0xe2/0x140
<4>[ 3579.940036]  [<ffffffff8104632c>] start_secondary+0x14c/0x160
<4>[ 3579.940046] Code: 1f 84 00 00 00 00 00 8b 87 f0 16 00 00 83 e8 01 
41 39 c0 0f 94 c0 0f b6 c0 5d c3 0f 1f 40 00 89 d2 83 87 18 17 00 00 01 
83 ee 01 <0f> b6 82 e0 a3 ee 81 66 83 84 87 c0 04 00 00 01 81 fe ff 00 00
<1>[ 3579.940047] RIP  [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.940048]  RSP <ffff88407fc86ae8>
<4>[ 3579.940048] CR2: 0000000081eea3dc

-- 
Konstantin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists