From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
To: mmx@riz.pl
Cc: fujita.tomonori@lab.ntt.co.jp, rientjes@google.com, cl@linux.com,
penberg@cs.helsinki.fi, linux-kernel@vger.kernel.org,
kernel-testers@vger.kernel.org, rjw@sisk.pl,
akpm@linux-foundation.org, jens.axboe@oracle.com
Subject: Re: [Bug #13112] Oops in drain_array
Date: Tue, 28 Apr 2009 23:44:51 +0900 [thread overview]
Message-ID: <20090428234512P.fujita.tomonori@lab.ntt.co.jp> (raw)
In-Reply-To: <Pine.LNX.4.64.0904281425040.2455@galaxy.riz.pl>
On Tue, 28 Apr 2009 14:43:37 +0200 (CEST)
Bart <mmx@riz.pl> wrote:
> > On Mon, 27 Apr 2009 13:36:46 -0700 (PDT)
> > David Rientjes <rientjes@google.com> wrote:
> >
> >> On Mon, 27 Apr 2009, Bart wrote:
> >>
> >>> After turning the suggested debuging options I've got tons of these when
> >>> trying to stress the tape device like before:
> >>>
> >>> Apr 27 16:57:30 fs kernel: [ 96.446708] slab error in verify_redzone_free():
> >>> cache `size-128': memory outside object was overwritten
> >>> Apr 27 16:57:30 fs kernel: [ 96.446713] Pid: 0, comm: swapper Not tainted
> >>> 2.6.29.1-64 #2
> >>> Apr 27 16:57:30 fs kernel: [ 96.446715] Call Trace:
> >>> Apr 27 16:57:30 fs kernel: [ 96.446717] <IRQ> [<ffffffff8029adc5>]
> >>> __slab_error+0x1f/0x25
> >>> Apr 27 16:57:30 fs kernel: [ 96.446728] [<ffffffff8029b24b>]
> >>> cache_free_debugcheck+0x108/0x1d6
> >>> Apr 27 16:57:30 fs kernel: [ 96.446731] [<ffffffff8029b473>]
> >>> kfree+0x81/0xc2
> >>> Apr 27 16:57:30 fs kernel: [ 96.446735] [<ffffffff802bd311>]
> >>> bio_free_map_data+0xc/0x1e
> >>
> >> This appears to be kfree(bmd->iovecs) in bio_free_map_data(). It looks
> >> like the memcpy size in bio_set_map_data() overrides the kmalloc size; in
> >> other words, for a redzone error, bio->bi_vcnt > nr_pages in
> >> bio_copy_user_iov().
> >
> > Can you try this?
> >
> > diff --git a/fs/bio.c b/fs/bio.c
> > index 7bbc98f..6a09356 100644
> > --- a/fs/bio.c
> > +++ b/fs/bio.c
> > @@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
> > len += iov[i].iov_len;
> > }
> >
> > + if (offset)
> > + nr_pages += 1;
> > +
> > bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
> > if (!bmd)
> > return ERR_PTR(-ENOMEM);
> >
>
> There are no more errors in the dmesg after applying this patch to
> 2.6.29.2.
>
> Without this patch I can reproduce this kind of errors on
> 2.6.29.1, 2.6.29.2.
>
> I've not tested this patch with 2.6.29.1 and 2.6.30rc3-git3.
> I will try to reproduce the error on 2.6.30rc3-git3 as soon as I compile
> it.
Thanks for testing! And very sorry about the bug.
I'm sure that you hit the same bug with 2.6.30-rc3-git.
Jens, can you please apply this against 2.6.30-rc (and we need this
for 2.6.29.x too)?
I know that bio_copy_user_iov() is hacky. I'll try to clean up the
mapping API later.
=
From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Subject: [PATCH] bio: fix memcpy corruption in bio_copy_user_iov()
st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.
Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
---
fs/bio.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/fs/bio.c b/fs/bio.c
index 7bbc98f..9871164 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
len += iov[i].iov_len;
}
+ if (offset)
+ nr_pages++;
+
bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
if (!bmd)
return ERR_PTR(-ENOMEM);
--
1.6.0.6
next prev parent reply other threads:[~2009-04-28 14:46 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-26 9:42 2.6.30-rc3-git1: Reported regressions 2.6.28 -> 2.6.29 Rafael J. Wysocki
2009-04-26 9:42 ` [Bug #12490] ath5k related kernel panic in 2.6.29-rc1 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12705] X200: Brightness broken since 2.6.29-rc4-58-g4c098bc Rafael J. Wysocki
2009-04-26 20:15 ` Nico Schottelius
2009-04-26 23:18 ` Rafael J. Wysocki
2009-04-30 8:00 ` Nico Schottelius
2009-04-26 9:46 ` [Bug #12681] s2ram: fails to wake up on Acer Extensa 4220 (SMP disabled) Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12499] Problem with using bluetooth adaper connected to usb port Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12947] r128: system hangs when X is started with DRI enabled Rafael J. Wysocki
2009-04-26 15:07 ` Angel
2009-04-26 17:43 ` Rafael J. Wysocki
2009-04-27 18:12 ` Jos van der Ende
2009-04-28 21:49 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12909] boot/kernel init duration regression from 2.6.28 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12899] Crash in i915.ko: i915_driver_irq_handler Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12861] Xorg fails to start "Failed to allocate space for kernel memory manager" Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12765] i915 VT switch with AIGLX causes X lock up Rafael J. Wysocki
2009-04-27 16:46 ` Jesse Barnes
2009-04-27 22:07 ` Sitsofe Wheeler
2009-04-26 9:46 ` [Bug #12836] 2.6.29-rc breaks STD using Intel 945 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12971] "tg3 transmit timed out" when transmitting at high bitrate Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12980] lockup in X.org Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12961] Kernel panics in early boot: IO-APIC + timer doesn't work Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13001] PCI-DMA: Out of IOMMU space Rafael J. Wysocki
2009-04-28 8:28 ` FUJITA Tomonori
2009-04-28 9:18 ` Данила Жукоцкий
2009-04-28 9:43 ` FUJITA Tomonori
2009-05-04 5:27 ` Данила Жукоцкий
2009-05-05 1:58 ` Grant Grundler
2009-05-05 4:31 ` adam radford
2009-05-05 5:46 ` Данила Жукоцкий
2009-05-06 4:39 ` FUJITA Tomonori
2009-05-06 10:39 ` FUJITA Tomonori
2009-04-26 9:46 ` [Bug #13025] After upgrading to kernel 2.6.29, pulseaudio stopped with some strange error Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13003] [2.6.29 regression] ivtv driver causes strange oops'es, disrupts software suspend Rafael J. Wysocki
2009-04-27 6:46 ` Hans Verkuil
2009-04-28 21:53 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13032] 2.6.29 regression: network interfaces drop after suspend/resume Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13040] DRM radeon Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13074] gspca_stv06xx doesn't work with Logitech QuickCam Express (046d:0840) Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13072] forcedeth seems to switch off eth on shutdown Rafael J. Wysocki
2009-04-26 20:52 ` Daniel Bierstedt
[not found] ` <1240778558.4995.4.camel@laptop.workgroup>
2009-04-26 23:20 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13112] Oops in drain_array Rafael J. Wysocki
2009-04-26 20:19 ` David Rientjes
2009-04-27 8:52 ` Pekka Enberg
2009-04-27 14:04 ` Christoph Lameter
2009-04-27 16:58 ` Bart
2009-04-27 17:39 ` Christoph Lameter
2009-04-28 13:05 ` Bart
2009-04-27 20:36 ` David Rientjes
2009-04-28 6:47 ` Jens Axboe
2009-04-28 8:11 ` FUJITA Tomonori
2009-04-28 12:43 ` Bart
2009-04-28 14:44 ` FUJITA Tomonori [this message]
2009-04-28 18:22 ` Jens Axboe
2009-04-26 9:46 ` [Bug #13100] can't anymore even do a s2ram-s2disk-s2ram cycle on acer aspire 5720G Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13172] Spontaneous reboots since 2.6.29-rc* Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13144] resume from suspend fails using video card i915 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13175] sata_nv incompatible with async scsi scan Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13184] Left audio channel broken after resume from suspend with Intel HDA Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13183] forcedeth: no link during initialization Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13178] Booting very slow Rafael J. Wysocki
2009-04-27 7:18 ` Martin Knoblauch
2009-04-26 9:46 ` [Bug #13186] cpufreq timer teardown problem Rafael J. Wysocki
2009-04-26 16:28 ` Mathieu Desnoyers
2009-04-26 17:45 ` Rafael J. Wysocki
2009-04-26 18:32 ` Mathieu Desnoyers
2009-04-26 12:47 ` 2.6.30-rc3-git1: Reported regressions 2.6.28 -> 2.6.29 Matthew Wilcox
-- strict thread matches above, loose matches on Subject: below --
2009-04-16 21:42 2.6.30-rc2-git2: Reported regressions from 2.6.29 Rafael J. Wysocki
2009-04-16 21:45 ` [Bug #13112] Oops in drain_array Rafael J. Wysocki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090428234512P.fujita.tomonori@lab.ntt.co.jp \
--to=fujita.tomonori@lab.ntt.co.jp \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=jens.axboe@oracle.com \
--cc=kernel-testers@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mmx@riz.pl \
--cc=penberg@cs.helsinki.fi \
--cc=rientjes@google.com \
--cc=rjw@sisk.pl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).