linux-kernel - Re: Regression 4.17-rc1: SSD doesn properly resume causing system hang (NULL pointer dereference)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Apr 2018 19:37:42 +0200
From:   Paul Menzel <pmenzel+linux-block@...gen.mpg.de>
To:     Bart Van Assche <Bart.VanAssche@....com>, axboe@...nel.dk
Cc:     martin.petersen@...cle.com, jejb@...ux.vnet.ibm.com,
        regressions@...mhuis.info, linux-kernel@...r.kernel.org,
        linux-block@...r.kernel.org, linux-scsi@...r.kernel.org
Subject: Re: Regression 4.17-rc1: SSD doesn properly resume causing system
 hang (NULL pointer dereference)

Dear Bart,


On 04/24/18 19:31, Bart Van Assche wrote:
> On Tue, 2018-04-24 at 19:10 +0200, Paul Menzel wrote:
>> Please find the configuration file attached. The log only has
>> `initcall_debug no_console_suspend` added.
> 
> What I was looking for in the .config is the following:
> CONFIG_SCSI_MQ_DEFAULT=y
> 
> Can you also provide the disassembly output for blk_set_runtime_active,
> e.g. by loading vmlinux into gdb and by running the command "disas
> blk_set_runtime_active"?

Here it is, pasted as citation, as otherwise Thunderbird would wrap the 
line.

> (gdb) disas blk_set_runtime_active
> Dump of assembler code for function blk_set_runtime_active:
>    0xc1518610 <+0>:	call   0xc106ac9c <__fentry__>
>    0xc1518615 <+5>:	push   %ebp
>    0xc1518616 <+6>:	mov    %esp,%ebp
>    0xc1518618 <+8>:	sub    $0x14,%esp
>    0xc151861b <+11>:	mov    %ebx,-0xc(%ebp)
>    0xc151861e <+14>:	mov    %eax,%ebx
>    0xc1518620 <+16>:	mov    %gs:0x14,%eax
>    0xc1518626 <+22>:	mov    %eax,-0x10(%ebp)
>    0xc1518629 <+25>:	xor    %eax,%eax
>    0xc151862b <+27>:	test   %ebx,%ebx
>    0xc151862d <+29>:	mov    %esi,-0x8(%ebp)
>    0xc1518630 <+32>:	mov    %edi,-0x4(%ebp)
>    0xc1518633 <+35>:	je     0xc15186b3 <blk_set_runtime_active+163>
>    0xc1518635 <+37>:	mov    0xfc(%ebx),%eax
>    0xc151863b <+43>:	call   0xc1a4b920 <_raw_spin_lock_irq>
>    0xc1518640 <+48>:	mov    0x150(%ebx),%esi
>    0xc1518646 <+54>:	xor    %eax,%eax
>    0xc1518648 <+56>:	mov    0xc1ca7d20,%edi
>    0xc151864e <+62>:	mov    %eax,0x154(%ebx)
>    0xc1518654 <+68>:	cmp    $0xffffff0c,%esi
>    0xc151865a <+74>:	mov    %edi,-0x14(%ebp)
>    0xc151865d <+77>:	je     0xc15186a5 <blk_set_runtime_active+149>
>    0xc151865f <+79>:	mov    %edi,0xf4(%esi)
>    0xc1518665 <+85>:	mov    $0x9,%edx
>    0xc151866a <+90>:	mov    0x150(%ebx),%eax
>    0xc1518670 <+96>:	call   0xc175ab80 <__pm_runtime_suspend>
>    0xc1518675 <+101>:	mov    0xfc(%ebx),%eax
>    0xc151867b <+107>:	call   *0xc1ce2918
>    0xc1518681 <+113>:	call   *0xc1ce2888
>    0xc1518687 <+119>:	mov    -0x10(%ebp),%eax
>    0xc151868a <+122>:	xor    %gs:0x14,%eax
>    0xc1518691 <+129>:	jne    0xc15186a0 <blk_set_runtime_active+144>
>    0xc1518693 <+131>:	mov    -0xc(%ebp),%ebx
>    0xc1518696 <+134>:	mov    -0x8(%ebp),%esi
>    0xc1518699 <+137>:	mov    -0x4(%ebp),%edi
>    0xc151869c <+140>:	mov    %ebp,%esp
>    0xc151869e <+142>:	pop    %ebp
>    0xc151869f <+143>:	ret    
>    0xc15186a0 <+144>:	call   0xc108c6c0 <__stack_chk_fail>
>    0xc15186a5 <+149>:	xor    %edx,%edx
>    0xc15186a7 <+151>:	mov    $0xc1ee14b4,%eax
>    0xc15186ac <+156>:	call   0xc15bb7f0 <__ubsan_handle_type_mismatch>
>    0xc15186b1 <+161>:	jmp    0xc151865f <blk_set_runtime_active+79>
>    0xc15186b3 <+163>:	xor    %edx,%edx
>    0xc15186b5 <+165>:	mov    $0xc1ee14cc,%eax
>    0xc15186ba <+170>:	call   0xc15bb7f0 <__ubsan_handle_type_mismatch>
>    0xc15186bf <+175>:	jmp    0xc1518635 <blk_set_runtime_active+37>
> End of assembler dump.


Kind regards,

Paul


PS: By the way, your mailer stripped the full names of my first message, 
and replace the “names” with the email address.


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5174 bytes)