linux-kernel - NFS/TCP crashes on MIPS/RBTX4927 in v4.20-rcX (bisected)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdVJr0PwvJg3FeTCy7vxuyY1=S1tPLHO7hPsoZX4wZ+-cQ@mail.gmail.com>
Date:   Tue, 4 Dec 2018 14:53:07 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Trond Myklebust <trond.myklebust@...merspace.com>
Cc:     Atsushi Nemoto <anemo@....ocn.ne.jp>,
        "open list:NFS, SUNRPC, AND..." <linux-nfs@...r.kernel.org>,
        linux-mips@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: NFS/TCP crashes on MIPS/RBTX4927 in v4.20-rcX (bisected)

        Hi Trond,

Recently, I've upgraded my NFS server to Ubuntu 18.04LTS.  Apparently
the NFS server in that release dropped support for NFS over UDP, hence I
appended ",tcp,v3" to all my nfsroot kernel command line parameters.
This works fine on my arm/arm64 development boards, but causes a crash
on RBTX4927:

    VFS: Mounted root (nfs filesystem) on device 0:13.
    devtmpfs: mounted
    Freeing prom memory: 1020k freed
    Freeing unused kernel memory: 208K
    This architecture does not have kernel memory protection.
    Run /sbin/init as init process
    do_page_fault(): sending SIGSEGV to init for invalid read access
from 57e7e414
    epc = 77f9e188 in ld-2.19.so[77f9c000+22000]
    ra  = 77f9d91c in ld-2.19.so[77f9c000+22000]
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

I found similar crashes in a report from 2006, but of course the code
has changed too much to apply the solution proposed there
(https://www.linux-mips.org/archives/linux-mips/2006-09/msg00169.html).

Userland is Debian 8 (the last release supporting "old" MIPS).
My kernel is based on v4.20.0-rc5, but the issue happens with v4.20-rc1,
too.

However, I noticed it works in v4.19! Hence I've bisected this, to commit
277e4ab7d530bf28 ("SUNRPC: Simplify TCP receive code by switching to using
iterators").

Dropping the ",tcp" part from the nfsroot parameter also fixes the issue.

Given RBTX4926 is little endian, just like my arm/arm64 boards, it's probably
not an endianness issue.  Sparse didn't show anything suspicious before/after
the guilty commit.

Do you have a clue?
Thanks!

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds