From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Dave Jones <davej@codemonkey.org.uk>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
linux-nfs@vger.kernel.org, linux-hardening@vger.kernel.org,
Trond Myklebust <trond.myklebust@hammerspace.com>,
Scott Mayhew <smayhew@redhat.com>,
Anna Schumaker <anna@kernel.org>,
Kees Cook <keescook@chromium.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount
Date: Mon, 17 Oct 2022 10:58:55 +0700 [thread overview]
Message-ID: <Y0zS/5WLi2q4Ua2U@debian.me> (raw)
In-Reply-To: <Y0zEzZwhOxTDcBTB@codemonkey.org.uk>
[-- Attachment #1: Type: text/plain, Size: 3801 bytes --]
On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> Started getting this during mount on a 6.1rc1 kernel..
> not sure which mount it's complaining about, but they're all v3 tcp
> mounts on that machine.
>
> [ 19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
> [ 19.617504] WARNING: CPU: 3 PID: 1300 at fs/nfs/super.c:857 nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [ 19.617528] CPU: 3 PID: 1300 Comm: mount.nfs Not tainted 6.1.0-rc1-backup+ #1
> [ 19.617553] RIP: 0010:nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [ 19.617566] Code: 16 81 01 00 75 9b 48 c7 c1 ff ff ff ff 48 c7 c2 a8 a8 82 ab 4c 89 e6 c6 05 36 16 81 01 01 48 c7 c7 a8 3a 81 ab e8 61 1d 9a 00 <0f> 0b 48 8b 3c 24 e9 6c ff ff ff c7 83 20 01 00 00 01 00 00 00 b8
> [ 19.617593] RSP: 0018:ffffc900027fbd48 EFLAGS: 00010286
> [ 19.617604] RAX: 0000000000000000 RBX: ffff8881208d5000 RCX: ffff88842fadb7a8
> [ 19.617617] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff88842fadb7a0
> [ 19.617629] RBP: ffff8881208d5130 R08: 0000000000000000 R09: ffffffffaba5c540
> [ 19.617641] R10: 0000000000000001 R11: 0000000000000001 R12: 000000000000001c
> [ 19.617653] R13: 0000000000000001 R14: ffffc900027fbef0 R15: ffff888100b3bea0
> [ 19.617665] FS: 00007ff793dd6840(0000) GS:ffff88842fac0000(0000) knlGS:0000000000000000
> [ 19.617679] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 19.617690] CR2: 0000564a1a747468 CR3: 00000001106fb003 CR4: 00000000001706e0
> [ 19.617703] Call Trace:
> [ 19.617709] <TASK>
> [ 19.617716] nfs_try_get_tree+0xa1/0x220
> [ 19.617725] ? get_nfs_version+0x63/0x130
> [ 19.617736] vfs_get_tree+0x1d/0x90
> [ 19.617746] ? capable+0x2f/0x50
> [ 19.617755] path_mount+0x75c/0xb00
> [ 19.617766] __x64_sys_mount+0x19a/0x200
> [ 19.617775] do_syscall_64+0x35/0x80
> [ 19.617785] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> [ 19.617796] RIP: 0033:0x7ff7941ac6ea
> [ 19.617805] Code: 48 8b 0d a9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 17 0d 00 f7 d8 64 89 01 48
> [ 19.617832] RSP: 002b:00007ffd02ae4ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> [ 19.617846] RAX: ffffffffffffffda RBX: 00007ffd02ae4e70 RCX: 00007ff7941ac6ea
> [ 19.617858] RDX: 0000564a1a73fb60 RSI: 0000564a1a73fb80 RDI: 0000564a1a741890
> [ 19.617870] RBP: 00007ff793dd67b8 R08: 0000564a1a73f480 R09: 0000564a1a73f480
> [ 19.617882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [ 19.617894] R13: 00007ffd02ae4dd0 R14: 0000564a1a7474e0 R15: 0000564a1a7436b0
> [ 19.617907] </TASK>
> [ 19.617913] irq event stamp: 8757
> [ 19.617920] hardirqs last enabled at (8769): [<ffffffffaa1397c2>] __up_console_sem+0x52/0x60
> [ 19.617937] hardirqs last disabled at (8780): [<ffffffffaa1397a7>] __up_console_sem+0x37/0x60
> [ 19.617952] softirqs last enabled at (8180): [<ffffffffaabf547a>] sk_common_release+0x5a/0xe0
> [ 19.617969] softirqs last disabled at (8178): [<ffffffffaabf5456>] sk_common_release+0x36/0xe0
> [ 19.617984] ---[ end trace 0000000000000000 ]---
>
Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
author. Also Cc: Kees for authoring the patch [1] that have fixed
similar warning.
Also, does v6.0 have this warning? If so, you need to bisect in the range
of v6.0..v6.1-rc1.
Thanks.
[1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next prev parent reply other threads:[~2022-10-17 3:59 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-16 23:01 Linux 6.1-rc1 Linus Torvalds
2022-10-17 1:53 ` linux-next: stats for 6.1-rc1 (was: Linux 6.1-rc1) Stephen Rothwell
2022-10-17 2:58 ` 6.1rc1: NFS memcpy warning on mount Dave Jones
2022-10-17 3:58 ` Bagas Sanjaya [this message]
2022-10-17 4:17 ` Kees Cook
2022-10-17 4:20 ` Bagas Sanjaya
2022-10-17 4:57 ` Kees Cook
2022-10-17 12:34 ` Linux 6.1-rc1 Guenter Roeck
2022-10-17 17:39 ` Linus Torvalds
2022-10-17 18:28 ` Guenter Roeck
2022-10-17 18:54 ` Conor Dooley
2022-10-18 0:03 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y0zS/5WLi2q4Ua2U@debian.me \
--to=bagasdotme@gmail.com \
--cc=anna@kernel.org \
--cc=davej@codemonkey.org.uk \
--cc=keescook@chromium.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=smayhew@redhat.com \
--cc=torvalds@linux-foundation.org \
--cc=trond.myklebust@hammerspace.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).