| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240129172200.1725f01b@gandalf.local.home>
Date: Mon, 29 Jan 2024 17:22:00 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: kernel test robot <oliver.sang@...el.com>, oe-lkp@...ts.linux.dev,
lkp@...el.com, linux-kernel@...r.kernel.org, Masami Hiramatsu
<mhiramat@...nel.org>, Mark Rutland <mark.rutland@....com>, Mathieu
Desnoyers <mathieu.desnoyers@...icios.com>, Christian Brauner
<brauner@...nel.org>, Al Viro <viro@...iv.linux.org.uk>, Ajay Kaher
<ajay.kaher@...adcom.com>, linux-trace-kernel@...r.kernel.org
Subject: Re: [linus:master] [eventfs] 852e46e239:
BUG:unable_to_handle_page_fault_for_address
On Mon, 29 Jan 2024 12:51:59 -0800
Linus Torvalds <torvalds@...ux-foundation.org> wrote:
> [0004-tracefs-dentry-lookup-crapectomy.patch text/x-patch (11761 bytes)]
I had to add:
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index cd6de3244442..89897d934302 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -230,7 +230,6 @@ static struct eventfs_inode *eventfs_find_events(struct dentry *dentry)
{
struct eventfs_inode *ei;
- mutex_lock(&eventfs_mutex);
do {
// The parent is stable because we do not do renames
dentry = dentry->d_parent;
@@ -247,7 +246,6 @@ static struct eventfs_inode *eventfs_find_events(struct dentry *dentry)
}
// Walk upwards until you find the events inode
} while (!ei->is_events);
- mutex_unlock(&eventfs_mutex);
update_top_events_attr(ei, dentry->d_sb);
As eventfs_find_events() is only called by update_inode_attr() which is
only called by: lookup_file() and lookup_dir_entry() which are called by
eventfs_root_lookup() where eventfs_mutex is already held.
But crashes with just a:
# ls /sys/kernel/tracing/events
[ 66.423983] ------------[ cut here ]------------
[ 66.426447] kernel BUG at fs/dcache.c:1876!
[ 66.428363] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
[ 66.430320] CPU: 4 PID: 863 Comm: ls Not tainted 6.8.0-rc1-test-00009-gcaff43732484-dirty #463
[ 66.433192] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 66.436122] RIP: 0010:d_instantiate+0x69/0x70
[ 66.437537] Code: 00 4c 89 e7 e8 18 f0 49 01 48 89 df 48 89 ee e8 0d fe ff ff 4c 89 e7 5b 5d 41 5c e9 e1 f3 49 01 5b 5d 41 5c c3 cc cc cc cc 90 <0f> 0b 90 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
[ 66.442759] RSP: 0018:ffffc900015f7830 EFLAGS: 00010282
[ 66.444315] RAX: 0000000000000000 RBX: ffff8881006aec40 RCX: ffffffffb77fcbff
[ 66.446237] RDX: dffffc0000000000 RSI: ffff888127c46ec0 RDI: ffff8881006aed70
[ 66.448170] RBP: ffff888127c46ec0 R08: 0000000000000001 R09: fffffbfff7766c4f
[ 66.450094] R10: ffffffffbbb3627f R11: 0000000000000000 R12: 00000000000081a0
[ 66.452007] R13: ffff88810f850000 R14: 0000000000000000 R15: 0000000000000000
[ 66.455224] FS: 00007fe1e56d9800(0000) GS:ffff88823c800000(0000) knlGS:0000000000000000
[ 66.457484] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 66.459139] CR2: 0000556b5293b000 CR3: 000000010f056001 CR4: 0000000000170ef0
[ 66.461192] Call Trace:
[ 66.462094] <TASK>
[ 66.462915] ? die+0x36/0x90
[ 66.463928] ? do_trap+0x133/0x230
[ 66.465089] ? d_instantiate+0x69/0x70
[ 66.466325] ? d_instantiate+0x69/0x70
[ 66.467532] ? do_error_trap+0x90/0x130
[ 66.468787] ? d_instantiate+0x69/0x70
[ 66.470020] ? handle_invalid_op+0x2c/0x40
[ 66.471340] ? d_instantiate+0x69/0x70
[ 66.472559] ? exc_invalid_op+0x2e/0x50
[ 66.473807] ? asm_exc_invalid_op+0x1a/0x20
[ 66.475154] ? d_instantiate+0x1f/0x70
[ 66.476396] ? d_instantiate+0x69/0x70
[ 66.477629] eventfs_root_lookup+0x366/0x660
[ 66.479021] ? __pfx_eventfs_root_lookup+0x10/0x10
[ 66.480567] ? print_circular_bug_entry+0x170/0x170
[ 66.482107] ? lockdep_init_map_type+0xd3/0x3a0
[ 66.485243] __lookup_slow+0x194/0x2a0
[ 66.486410] ? __pfx___lookup_slow+0x10/0x10
[ 66.487694] ? rwsem_read_trylock+0x118/0x1b0
[ 66.489057] ? i915_ttm_backup+0x2a0/0x5e0
[ 66.490358] ? down_read+0xbb/0x240
[ 66.491506] ? down_read+0xbb/0x240
[ 66.492674] ? trace_preempt_on+0xc8/0xe0
[ 66.493962] ? i915_ttm_backup+0x2a0/0x5e0
[ 66.495291] walk_component+0x166/0x220
[ 66.496564] path_lookupat+0xa9/0x2e0
[ 66.497766] ? __pfx_mark_lock+0x10/0x10
[ 66.499026] filename_lookup+0x19c/0x350
[ 66.500335] ? __pfx_filename_lookup+0x10/0x10
[ 66.501688] ? __pfx___lock_acquire+0x10/0x10
[ 66.502996] ? __pfx___lock_acquire+0x10/0x10
[ 66.504305] ? _raw_read_unlock_irqrestore+0x40/0x80
[ 66.505765] ? stack_depot_save_flags+0x1f0/0x790
[ 66.507137] vfs_statx+0xe1/0x270
[ 66.508196] ? __pfx_vfs_statx+0x10/0x10
[ 66.509385] ? __virt_addr_valid+0x155/0x330
[ 66.510667] ? __pfx_lock_release+0x10/0x10
[ 66.511924] do_statx+0xac/0x110
[ 66.515394] ? __pfx_do_statx+0x10/0x10
[ 66.516631] ? getname_flags.part.0+0xd6/0x260
[ 66.517956] __x64_sys_statx+0xa0/0xc0
[ 66.519079] do_syscall_64+0xca/0x1e0
[ 66.520206] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 66.521674] RIP: 0033:0x7fe1e586e2ea
[ 66.522780] Code: 48 8b 05 31 bb 0d 00 ba ff ff ff ff 64 c7 00 16 00 00 00 e9 a5 fd ff ff e8 03 10 02 00 0f 1f 00 41 89 ca b8 4c 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2e 89 c1 85 c0 74 0f 48 8b 05 f9 ba 0d 00 64
[ 66.527728] RSP: 002b:00007fff06f5ef98 EFLAGS: 00000246 ORIG_RAX: 000000000000014c
[ 66.529922] RAX: ffffffffffffffda RBX: 0000556b52935d18 RCX: 00007fe1e586e2ea
[ 66.531863] RDX: 0000000000000900 RSI: 00007fff06f5f0d0 RDI: 00000000ffffff9c
[ 66.533832] RBP: 0000000000000002 R08: 00007fff06f5efa0 R09: 0000000000000000
[ 66.535768] R10: 0000000000000002 R11: 0000000000000246 R12: 00007fff06f5f0d0
[ 66.537733] R13: 0000000000000005 R14: 0000556b52935d00 R15: 0000000000000003
[ 66.539682] </TASK>
[ 66.540454] Modules linked in: vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common vsock ip_tables
[ 66.543272] ---[ end trace 0000000000000000 ]---
void d_instantiate(struct dentry *entry, struct inode * inode)
{
BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); <<<--- HERE
if (inode) {
security_d_instantiate(entry, inode);
spin_lock(&inode->i_lock);
__d_instantiate(entry, inode);
spin_unlock(&inode->i_lock);
}
}
-- Steve
Powered by blists - more mailing lists