* [PATCH] pstore: do not use message compression without lock
@ 2015-04-21 11:32 Konstantin Khlebnikov
2015-05-14 16:00 ` Konstantin Khlebnikov
0 siblings, 1 reply; 3+ messages in thread
From: Konstantin Khlebnikov @ 2015-04-21 11:32 UTC (permalink / raw)
To: Tony Luck, Anton Vorontsov, linux-kernel, Kees Cook, Colin Cross
pstore_compress() uses static stream buffer for zlib-deflate which
easily crashes when several concurrent threads use one shared state.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
---
fs/pstore/platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index c4c9a10c5760..de525ec0b490 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
bool compressed;
size_t total_len;
- if (big_oops_buf) {
+ if (big_oops_buf && is_locked) {
dst = big_oops_buf;
hsize = sprintf(dst, "%s#%d Part%u\n", why,
oopscount, part);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] pstore: do not use message compression without lock
2015-04-21 11:32 [PATCH] pstore: do not use message compression without lock Konstantin Khlebnikov
@ 2015-05-14 16:00 ` Konstantin Khlebnikov
2015-05-21 16:30 ` Luck, Tony
0 siblings, 1 reply; 3+ messages in thread
From: Konstantin Khlebnikov @ 2015-05-14 16:00 UTC (permalink / raw)
To: Tony Luck, Anton Vorontsov, linux-kernel, Kees Cook, Colin Cross,
Aruna Balakrishnaiah
On 21.04.2015 14:32, Konstantin Khlebnikov wrote:
> pstore_compress() uses static stream buffer for zlib-deflate which
> easily crashes when several concurrent threads use one shared state.
>
> Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> ---
> fs/pstore/platform.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
> index c4c9a10c5760..de525ec0b490 100644
> --- a/fs/pstore/platform.c
> +++ b/fs/pstore/platform.c
> @@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
> bool compressed;
> size_t total_len;
>
> - if (big_oops_buf) {
> + if (big_oops_buf && is_locked) {
> dst = big_oops_buf;
> hsize = sprintf(dst, "%s#%d Part%u\n", why,
> oopscount, part);
>
Bump
Example of crash:
<1>[ 3579.939946] BUG: unable to handle kernel paging request at
0000000081eea3dc
<1>[ 3579.939951] IP: [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.939953] PGD 0
<4>[ 3579.939954] Oops: 0000 [#1] SMP
<4>[ 3579.939970] Modules linked in: netconsole configfs 8021q mrp garp
stp llc x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
crc32_pclmul ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw
gf128mul glue_helper aes_x86_64 microcode sb_edac edac_core ipmi_si
ipmi_msghandler ast ttm drm_kms_helper drm sysimgblt sysfillrect
syscopyarea lpc_ich mlx4_en mlx4_core vxlan udp_tunnel ip6_udp_tunnel
tcp_htcp igb dca i2c_algo_bit isci i2c_core ptp libsas ahci pps_core
scsi_transport_sas libahci raid10 raid456 async_pq async_xor xor
async_memcpy async_raid6_recov raid6_pq async_tx raid1 raid0 multipath
linear
<4>[ 3579.939972] CPU: 12 PID: 0 Comm: swapper/12 Tainted: G W
3.18.11-11 #4
<4>[ 3579.939974] task: ffff883fd2e4baa0 ti: ffff881fd31fc000 task.ti:
ffff881fd31fc000
<4>[ 3579.939976] RIP: 0010:[<ffffffff81382274>] [<ffffffff81382274>]
zlib_tr_tally+0xe4/0x130
<4>[ 3579.939976] RSP: 0018:ffff88407fc86ae8 EFLAGS: 00010016
<4>[ 3579.939977] RAX: 000000000000006c RBX: ffff881fd0080000 RCX:
ffff881fd0087348
<4>[ 3579.939978] RDX: 00000000fffffffc RSI: 000000000000003f RDI:
ffff881fd0080000
<4>[ 3579.939978] RBP: ffff88407fc86ae8 R08: 000000000000006d R09:
0000000000000041
<4>[ 3579.939978] R10: ffff881fd0081748 R11: 0000000000000000 R12:
0000000000000577
<4>[ 3579.939979] R13: 0000000000003ae1 R14: 0000000000000005 R15:
ffff881fd00700c8
<4>[ 3579.939980] FS: 0000000000000000(0000) GS:ffff88407fc80000(0000)
knlGS:0000000000000000
<4>[ 3579.939980] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 3579.939981] CR2: 0000000081eea3dc CR3: 0000000001c14000 CR4:
00000000001407e0
<4>[ 3579.939981] Stack:
<4>[ 3579.939982] ffff88407fc86b18 ffffffff8137ef38 ffff881fd0080000
ffffffff81ee4340
<4>[ 3579.939983] 0000000000000005 0000000000000f00 ffff88407fc86b48
ffffffff8137fa23
<4>[ 3579.939984] ffff883fcff90000 0000000000000010 0000000000000002
0000000000000fc1
<4>[ 3579.939985] Call Trace:
<4>[ 3579.939986] <NMI>
<4>[ 3579.939987] [<ffffffff8137ef38>] deflate_slow+0x218/0x420
<4>[ 3579.939989] [<ffffffff8137fa23>] zlib_deflate+0xc3/0x400
<4>[ 3579.939993] [<ffffffff812de50e>] pstore_dump+0x26e/0x410
<4>[ 3579.939997] [<ffffffff810b0da7>] kmsg_dump+0x127/0x160
<4>[ 3579.939998] [<ffffffff810febe2>] watchdog_overflow_callback+0xa2/0xc0
<4>[ 3579.940001] [<ffffffff8113a3a8>] __perf_event_overflow+0x98/0x230
<4>[ 3579.940004] [<ffffffff8102c34a>] ?
x86_perf_event_set_period+0xda/0x150
<4>[ 3579.940005] [<ffffffff8113ae04>] perf_event_overflow+0x14/0x20
<4>[ 3579.940007] [<ffffffff810338c9>] intel_pmu_handle_irq+0x1d9/0x3c0
<4>[ 3579.940009] [<ffffffff81182641>] ?
unmap_kernel_range_noflush+0x11/0x20
<4>[ 3579.940011] [<ffffffff813f9768>] ? ghes_copy_tofrom_phys+0x118/0x1f0
<4>[ 3579.940013] [<ffffffff8102b694>] perf_event_nmi_handler+0x34/0x60
<4>[ 3579.940014] [<ffffffff81018b9a>] nmi_handle+0x8a/0x150
<4>[ 3579.940016] [<ffffffff813fa600>] ?
ghes_print_estatus.constprop.12+0x70/0x70
<4>[ 3579.940017] [<ffffffff81019266>] default_do_nmi+0x56/0x160
<4>[ 3579.940018] [<ffffffff81019400>] do_nmi+0x90/0xd0
<4>[ 3579.940020] [<ffffffff816d34e1>] end_repeat_nmi+0x1e/0x2e
<4>[ 3579.940023] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940024] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940026] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940027] <<EOE>>
<4>[ 3579.940029] [<ffffffff81574787>] cpuidle_enter_state+0x57/0x1d0
<4>[ 3579.940030] [<ffffffff815749c7>] cpuidle_enter+0x17/0x20
<4>[ 3579.940032] [<ffffffff810a893f>] cpu_startup_entry+0x34f/0x3d0
<4>[ 3579.940034] [<ffffffff810cd772>] ?
clockevents_register_device+0xe2/0x140
<4>[ 3579.940036] [<ffffffff8104632c>] start_secondary+0x14c/0x160
<4>[ 3579.940046] Code: 1f 84 00 00 00 00 00 8b 87 f0 16 00 00 83 e8 01
41 39 c0 0f 94 c0 0f b6 c0 5d c3 0f 1f 40 00 89 d2 83 87 18 17 00 00 01
83 ee 01 <0f> b6 82 e0 a3 ee 81 66 83 84 87 c0 04 00 00 01 81 fe ff 00 00
<1>[ 3579.940047] RIP [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.940048] RSP <ffff88407fc86ae8>
<4>[ 3579.940048] CR2: 0000000081eea3dc
--
Konstantin
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH] pstore: do not use message compression without lock
2015-05-14 16:00 ` Konstantin Khlebnikov
@ 2015-05-21 16:30 ` Luck, Tony
0 siblings, 0 replies; 3+ messages in thread
From: Luck, Tony @ 2015-05-21 16:30 UTC (permalink / raw)
To: Konstantin Khlebnikov, Anton Vorontsov, linux-kernel, Kees Cook,
Colin Cross, Aruna Balakrishnaiah
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 430 bytes --]
> - if (big_oops_buf) {
> + if (big_oops_buf && is_locked) {
> dst = big_oops_buf;
> hsize = sprintf(dst, "%s#%d Part%u\n", why,
> Bump
Thanks for the reminder. Applied. Should show up in linux-next soon, and then go to Linus in next merge window
-Tony
ÿôèº{.nÇ+‰·Ÿ®‰†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a¢f£¢·hšïêÿ‘êçz_è®\x03(階ŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨èÚ&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-05-21 16:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-04-21 11:32 [PATCH] pstore: do not use message compression without lock Konstantin Khlebnikov
2015-05-14 16:00 ` Konstantin Khlebnikov
2015-05-21 16:30 ` Luck, Tony
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).