linux-kernel - Re: WARNING: CPU: 1 PID: 14735 at fs/dcache.c:365 dentry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7bc6b466-9b9a-b857-8f72-2dce99b18939@gmx.de>
Date:   Sun, 17 Jul 2022 11:42:48 +0200
From:   Helge Deller <deller@....de>
To:     Hillf Danton <hdanton@...a.com>
Cc:     linux-kernel@...r.kernel.org, linux-parisc@...r.kernel.org
Subject: Re: WARNING: CPU: 1 PID: 14735 at fs/dcache.c:365
 dentry_free+0x100/0x128

Hi Hillf,

On 7/16/22 07:27, Helge Deller wrote:
> On 7/15/22 15:33, Hillf Danton wrote:
>> On Fri, 15 Jul 2022 10:18:23 +0200 Helge Deller  wrote:
> and this was the output:
>
> [108563.953441]  IAOQ[1]: dentry_free+0xc4/0x338
> [108564.005441]  RP(r2): __dentry_kill+0x284/0x2e8
> [108564.057443] Backtrace:
> [108564.089454]  [<000000004073bab0>] __dentry_kill+0x284/0x2e8
> [108564.157445]  [<000000004073d2f8>] dput+0x334/0x5a8
> [108564.213444]  [<00000000407267a4>] step_into+0x790/0xa88
> [108564.277444]  [<0000000040727084>] walk_component+0xa8/0x330
> [108564.345443]  [<00000000407275f8>] link_path_walk.part.0.constprop.0+0x2ec/0x4d0
> [108564.437443]  [<0000000040728254>] path_openat+0x150/0x1ba8
> [108564.501441]  [<000000004072ba28>] do_filp_open+0x9c/0x198
> [108564.569441]  [<0000000040701d20>] do_sys_openat2+0x14c/0x2a8
> [108564.637441]  [<0000000040702654>] compat_sys_openat+0x58/0xb8
> [108564.705440]  [<0000000040303e30>] syscall_exit+0x0/0x10
> [108564.769444]
> [108564.789435] ---[ end trace 0000000000000000 ]---
> [108564.845444] dentry = 000000031624e6c0
> [108564.889437] spin_is_locked(&dentry->d_lock) = 0
> [108564.945436] dname_external(dentry) = 0
> [108564.993436] dentry->d_flags & DCACHE_NORCU = 0
> [108565.045446] dentry->d_name.len = 3
> [108565.089435] dentry->d_name.hash = 89116695
> [108565.137435] dentry->d_lockref.count = -128
> [108565.189434] dentry->d_flags = 32776
> [108565.233435] dentry->d_inode = 0000000000000000
> [108565.285429] dentry->d_parent = 000000022ef756c0
> [108565.341434] dentry->d_u.d_rcu = 0x416be770
>
>> Add debug info to the diff below. Cut the first BUG_ON off if it>> triggers and see if the second one can be hit.

I used WARN_ON() instead of BUG_ON().
With that, both triggered, first the first one, then the second one.
Full log is here:
http://dellerweb.de/testcases/minicom.dcache.crash.6-warn

Helge

>> +++ y/fs/dcache.>> @@ -605,8 +605,10 @@ static void __dentry_kill(struct dentry
>>  		spin_unlock(&parent->d_lock);
>>  	if (dentry->d_inode)
>>  		dentry_unlink_inode(dentry);
>> -	else
>> +	else {
>> +		BUG_ON(!hlist_unhashed(&dentry->d_u.d_alias));
>>  		spin_unlock(&dentry->d_lock);
>> +	}
>>  	this_cpu_dec(nr_dentry);
>>  	if (dentry->d_op && dentry->d_op->d_release)
>>  		dentry->d_op->d_release(dentry);
>> @@ -616,6 +618,7 @@ static void __dentry_kill(struct dentry
>>  		dentry->d_flags |= DCACHE_MAY_FREE;
>>  		can_free = false;
>>  	}
>> +	BUG_ON(!hlist_unhashed(&dentry->d_u.d_alias));
>>  	spin_unlock(&dentry->d_lock);
>>  	if (likely(can_free))
>>  		dentry_free(dentry);