linux-kernel - Re: general protection fault (btrfs_real

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160518122113.GP14480@ZenIV.linux.org.uk>
Date:	Wed, 18 May 2016 13:21:14 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Markus Trippelsdorf <markus@...ppelsdorf.de>
Cc:	linux-kernel@...r.kernel.org, Chris Mason <clm@...com>
Subject: Re: general protection fault (btrfs_real_readdir)

On Wed, May 18, 2016 at 01:31:40PM +0200, Markus Trippelsdorf wrote:
> I'm running the latest Linus git tree and the parallel filesystem directory
> handling update seems to cause the following issue:
 
>  Call Trace:
>   [<ffffffff812f038b>] ? btrfs_real_readdir+0x44b/0x540
>   [<ffffffff811b064d>] ? SyS_getdents+0x12d/0x2a0
>   [<ffffffff811affa0>] ? SyS_ioctl+0x6a0/0x6a0
>   [<ffffffff810923db>] ? entry_SYSCALL_64_fastpath+0x13/0x8f
>  Code: 02 00 00 00 00 ad de eb 1e f0 ff 4b 60 74 73 49 8b 47 40 49 8d 57 40 4c 89 fb 48 39 d5 4c 8d 78 c0 0f 84 8d 00 00 00 48 8b 53 48 <48> 89 50 08 48 89 02 4c 89 6b 40 4c 89 63 48 48 8b 4b 21 49 3b 
>  RIP  [<ffffffff8134e9f3>] btrfs_readdir_delayed_dir_index+0x73/0x120
>   RSP <ffff8801076e3dc0>
>  ---[ end trace 91067801e8a68a7e ]---
> 
> This happened while I was building gcc, so the system was very busy.

>From a very superficial reading of delayed-inode.c, it looks like delayed
node might need locking...  This
        list_for_each_entry_safe(curr, next, ins_list, readdir_list) {
                list_del(&curr->readdir_list);
looks particularly unpleasant.  Just to make sure that this *is* just a
readdir issue (and not something involving lookups), could you try to
reproduce the breakage with 972b241f8 reverted?