linux-kernel - Re: [REGRESSION] "split bio_kmalloc from bio_alloc_bioset" causing crash shortly after bootup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Feb 2021 03:51:23 +0000
From:   Chaitanya Kulkarni <Chaitanya.Kulkarni@....com>
To:     Christoph Hellwig <hch@....de>
CC:     John Stultz <john.stultz@...aro.org>,
        Johannes Thumshirn <Johannes.Thumshirn@....com>,
        Damien Le Moal <Damien.LeMoal@....com>,
        Jens Axboe <axboe@...nel.dk>,
        David Anderson <dvander@...gle.com>,
        Alistair Delva <adelva@...gle.com>,
        Todd Kjos <tkjos@...gle.com>,
        Amit Pundir <amit.pundir@...aro.org>,
        YongQin Liu <yongqin.liu@...aro.org>,
        lkml <linux-kernel@...r.kernel.org>,
        "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>
Subject: Re: [REGRESSION] "split bio_kmalloc from bio_alloc_bioset" causing
 crash shortly after bootup

Christoph,

On 2/22/21 19:07, John Stultz wrote:
> [   34.785313]  bio_alloc_bioset+0x14/0x230
> [   34.796189]  bio_clone_fast+0x28/0x80
> [   34.799848]  bio_split+0x50/0xd0
> [   34.803072]  blk_crypto_fallback_encrypt_bio+0x2ec/0x5e8
> [   34.808384]  blk_crypto_fallback_bio_prep+0xfc/0x140
> [   34.813345]  __blk_crypto_bio_prep+0x13c/0x150
> [   34.817784]  submit_bio_noacct+0x3c0/0x548
> [   34.821880]  submit_bio+0x48/0x200
> [   34.825278]  ext4_io_submit+0x50/0x68
> [   34.828939]  ext4_writepages+0x558/0xca8
> [   34.832860]  do_writepages+0x58/0x108
> [   34.836522]  __writeback_single_inode+0x44/0x510
> [   34.841137]  writeback_sb_inodes+0x1e0/0x4a8
> [   34.845404]  __writeback_inodes_wb+0x78/0xe8
> [   34.849670]  wb_writeback+0x274/0x3e8
> [   34.853328]  wb_workfn+0x308/0x5f0
> [   34.856726]  process_one_work+0x1ec/0x4d0
> [   34.860734]  worker_thread+0x44/0x478
> [   34.864392]  kthread+0x140/0x150
> [   34.867618]  ret_from_fork+0x10/0x30
> [   34.871197] Code: a9ba7bfd 910003fd f9000bf3 7900bfa1 (f9403441)
> [   34.877289] ---[ end trace e6c2a3ab108278f0 ]---
> [   34.893636] Kernel panic - not syncing: Oops: Fatal exception
>
Looking at the other call sites do we need something like following ?

diff --git a/block/bounce.c b/block/bounce.c
index fc55314aa426..f8a3656e89c3 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -217,6 +217,7 @@ static void bounce_end_io_read_isa(struct bio *bio)
 static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
                struct bio_set *bs)
 {
+       unsigned int nr_iovecs = bio_segments(bio_src);
        struct bvec_iter iter;
        struct bio_vec bv;
        struct bio *bio;
@@ -243,7 +244,11 @@ static struct bio *bounce_clone_bio(struct bio
*bio_src, gfp_t gfp_mask,
         *    __bio_clone_fast() anyways.
         */
 
-       bio = bio_alloc_bioset(gfp_mask, bio_segments(bio_src), bs);
+       if (bs)
+               bio = bio_alloc_bioset(gfp_mask, nr_iovecs, bs);
+       else
+               bio = bio_kmalloc(gfp_mask, nr_iovecs);
+
        if (!bio)
                return NULL;
        bio->bi_bdev            = bio_src->bi_bdev;

Since __blk_queue_bounce() passes the NULL for the passthru case as a
bio_set value ?