From: Sasha Levin <sasha.levin@oracle.com>
To: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
serge.hallyn@canonical.com, ebiederm@xmission.com,
linux-kernel@vger.kernel.org, xemul@parallels.com,
catalin.marinas@arm.com, will.deacon@arm.com, jmorris@namei.org,
cmetcalf@tilera.com, joe.korty@ccur.com, dhowells@redhat.com,
dledford@redhat.com, viro@zeniv.linux.org.uk,
kosaki.motohiro@jp.fujitsu.com, linux-api@vger.kernel.org,
serue@us.ibm.com, tglx@linutronix.de, paulmck@linux.vnet.ibm.com,
devel@openvz.org, mtk.manpages@gmail.com,
Wu Fengguang <fengguang.wu@intel.com>
Subject: Re: [RFC PATCH v8 0/5] IPC: checkpoint/restore in userspace enhancements
Date: Sat, 22 Dec 2012 10:43:07 -0500 [thread overview]
Message-ID: <50D5D50B.8090309@oracle.com> (raw)
In-Reply-To: <50D4DB5D.9020309@oracle.com>
On 12/21/2012 04:57 PM, Sasha Levin wrote:
> On 12/21/2012 03:46 PM, Stanislav Kinsbursky wrote:
>> 21.12.2012 00:47, Andrew Morton пишет:
>>> On Thu, 20 Dec 2012 08:06:32 +0400
>>> Stanislav Kinsbursky<skinsbursky@parallels.com> wrote:
>>>
>>>> 19.12.2012 00:36, Andrew Morton __________:
>>>>> On Wed, 24 Oct 2012 19:34:51 +0400
>>>>> Stanislav Kinsbursky<skinsbursky@parallels.com> wrote:
>>>>>
>>>>>> This respin of the patch set was significantly reworked. Most part of new API
>>>>>> was replaced by sysctls (by one per messages, semaphores and shared memory),
>>>>>> allowing to preset desired id for next new IPC object.
>>>>>>
>>>>>> This patch set is aimed to provide additional functionality for all IPC
>>>>>> objects, which is required for migration of these objects by user-space
>>>>>> checkpoint/restore utils (CRIU).
>>>>>>
>>>>>> The main problem here was impossibility to set up object id. This patch set
>>>>>> solves the problem by adding new sysctls for preset of desired id for new IPC
>>>>>> object.
>>>>>>
>>>>>> Another problem was to peek messages from queues without deleting them.
>>>>>> This was achived by introducing of new MSG_COPY flag for sys_msgrcv(). If
>>>>>> MSG_COPY flag is set, then msgtyp is interpreted as message number.
>>>>> According to my extensive records, Sasha hit a bug in
>>>>> ipc-message-queue-copy-feature-introduced.patch and Fengguang found a
>>>>> bug in
>>>>> ipc-message-queue-copy-feature-introduced-cleanup-do_msgrcv-aroung-msg_copy-feature.patch
>>>>>
>>>>> It's not obvious (to me) that these things have been identified and
>>>>> fixed. What's the status, please?
>>>> Hello, Andrew.
>>>> Fengguang's issue was solved by "ipc: simplify message copying" I sent you.
>>>> But I can't find Sasha's issue. As I remember, there was some problem in
>>>> early
>>>> version of the patch set. But I believe its fixed now.
>>> http://lkml.indiana.edu/hypermail/linux/kernel/1210.3/01710.html
>>>
>>> Subject: "ipc, msgqueue: NULL ptr deref in msgrcv"
>>
>> Ah, yes. Thanks.
>> Hi found it in initial version of code, which was significantly changed (or cleaned and simplified) by further patch series.
>> And I cant find out, how this can happen, because this patch he bisect to do not modify the queue itself, while he found the
>> problem in testmsg.
>
> I actually can't reproduce it on the latest -next.
>
> I was reverting the IPC changes in the past couple of weeks so that I could test the
> rest of the IPC code with the fuzzer, and when I added them back in again I can't
> reproduce the issue I've reported earlier.
>
> We can probably figure out where it got fixed by bisecting between -next trees if anyone
> is interested in that.
Ignore that. It just took more fuzzing to stumble on it again:
[ 103.164594] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 103.168159] IP: [<ffffffff81937155>] do_msgrcv+0x205/0x540
[ 103.170031] PGD c7cd067 PUD d274067 PMD 0
[ 103.170031] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 103.170031] Dumping ftrace buffer:
[ 103.170031] (ftrace buffer empty)
[ 103.170031] CPU 4
[ 103.170031] Pid: 7056, comm: trinity Tainted: G W 3.7.0-next-20121221-sasha-00014-g339890c #229
[ 103.170031] RIP: 0010:[<ffffffff81937155>] [<ffffffff81937155>] do_msgrcv+0x205/0x540
[ 103.170031] RSP: 0018:ffff88000c7cfe88 EFLAGS: 00010246
[ 103.170031] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 103.170031] RDX: ffff880013681f00 RSI: 0000000000000124 RDI: ffff8800075a7810
[ 103.170031] RBP: ffff88000c7cff68 R08: 0000000000000000 R09: 0000000000000000
[ 103.170031] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002
[ 103.170031] R13: ffff8800075a78c0 R14: 7fffffff00000000 R15: ffff8800075a7810
[ 103.170031] FS: 00007ffa529ae700(0000) GS:ffff880013c00000(0000) knlGS:0000000000000000
[ 103.170031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.170031] CR2: 0000000000000010 CR3: 000000000c7cc000 CR4: 00000000000406e0
[ 103.170031] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 103.170031] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 103.170031] Process trinity (pid: 7056, threadinfo ffff88000c7ce000, task ffff88000c020000)
[ 103.170031] Stack:
[ 103.170031] ffff88000c7cfea8 ffff88000c020000 ffff88000c020000 ffff88000c020000
[ 103.170031] 0000000000000000 ffffffff81935e50 0000000000000008 0000000000000000
[ 103.170031] ffffffff858e91e0 0000000000000000 0000000000001001 ffff88000c020000
[ 103.170031] Call Trace:
[ 103.170031] [<ffffffff81935e50>] ? load_msg+0x170/0x170
[ 103.170031] [<ffffffff8107e8c4>] ? syscall_trace_enter+0x24/0x2e0
[ 103.170031] [<ffffffff81184678>] ? trace_hardirqs_on_caller+0x118/0x140
[ 103.170031] [<ffffffff819374a0>] sys_msgrcv+0x10/0x20
[ 103.170031] [<ffffffff83cdf798>] tracesys+0xe1/0xe6
[ 103.170031] Code: 80 f5 ff ff ff 90 41 83 fc 03 74 32 41 83 fc 04 74 0c 41 83 fc 02 75 2c eb 11 0f 1f 40 00 4c 3b 73 10 7d 20
66 90 e9 94 00 00 00 <4c> 39 73 10 0f 85 8a 00 00 00 90 eb 0c 66 0f 1f 44 00 00 4c 39
[ 103.170031] RIP [<ffffffff81937155>] do_msgrcv+0x205/0x540
[ 103.170031] RSP <ffff88000c7cfe88>
[ 103.170031] CR2: 0000000000000010
[ 103.228270] ---[ end trace ddc37199fdad82b0 ]---
Thanks,
Sasha
next prev parent reply other threads:[~2012-12-22 15:45 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-24 15:34 [RFC PATCH v8 0/5] IPC: checkpoint/restore in userspace enhancements Stanislav Kinsbursky
2012-10-24 15:35 ` [PATCH v8 1/5] ipc: remove forced assignment of selected message Stanislav Kinsbursky
2012-10-24 15:35 ` [PATCH v8 2/5] ipc: add sysctl to specify desired next object id Stanislav Kinsbursky
2012-10-24 21:41 ` Andrew Morton
2012-10-25 7:53 ` Stanislav Kinsbursky
2012-10-24 15:35 ` [PATCH v8 3/5] ipc: message queue receive cleanup Stanislav Kinsbursky
2012-10-24 15:35 ` [PATCH v8 4/5] ipc: message queue copy feature introduced Stanislav Kinsbursky
2012-10-24 21:41 ` Andrew Morton
2012-10-24 15:35 ` [PATCH v8 5/5] test: IPC message queue copy feture test Stanislav Kinsbursky
2012-10-24 21:42 ` [RFC PATCH v8 0/5] IPC: checkpoint/restore in userspace enhancements Andrew Morton
2012-12-18 20:36 ` Andrew Morton
2012-12-20 4:06 ` Stanislav Kinsbursky
2012-12-20 20:47 ` Andrew Morton
2012-12-21 20:46 ` Stanislav Kinsbursky
2012-12-21 21:57 ` Sasha Levin
2012-12-22 15:43 ` Sasha Levin [this message]
2013-01-09 8:24 ` Stanislav Kinsbursky
2013-01-14 6:31 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50D5D50B.8090309@oracle.com \
--to=sasha.levin@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=catalin.marinas@arm.com \
--cc=cmetcalf@tilera.com \
--cc=devel@openvz.org \
--cc=dhowells@redhat.com \
--cc=dledford@redhat.com \
--cc=ebiederm@xmission.com \
--cc=fengguang.wu@intel.com \
--cc=jmorris@namei.org \
--cc=joe.korty@ccur.com \
--cc=kosaki.motohiro@jp.fujitsu.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
--cc=paulmck@linux.vnet.ibm.com \
--cc=serge.hallyn@canonical.com \
--cc=serue@us.ibm.com \
--cc=skinsbursky@parallels.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
--cc=will.deacon@arm.com \
--cc=xemul@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).