From: Michael Stapelberg <michael+lkml@stapelberg.ch>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: fuse-devel <fuse-devel@lists.sourceforge.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Kyle Sanderson <kyle.leet@gmail.com>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: Still a pretty bad time on 5.4.6 with fuse_request_end.
Date: Wed, 12 Feb 2020 10:38:33 +0100 [thread overview]
Message-ID: <CANnVG6=s1C7LSDGD1-Ato-sfaKi1LQvW3GM5wfAiUqWXibEohw@mail.gmail.com> (raw)
In-Reply-To: <CAJfpegtX0Z3_OZFG50epWGHkW5aOMfYmn61WmqYC67aBmJyDMA@mail.gmail.com>
Unfortunately not: when I change the code like so:
bool async;
uint32_t opcode_early = req->args->opcode;
if (test_and_set_bit(FR_FINISHED, &req->flags))
goto put_request;
async = req->args->end;
…gdb only reports:
(gdb) bt
#0 0x000000a700000001 in ?? ()
#1 0xffffffff8137fc99 in fuse_copy_finish (cs=0x20000ffffffff) at
fs/fuse/dev.c:681
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
But maybe that’s a hint in and of itself?
On Wed, Feb 12, 2020 at 9:34 AM Miklos Szeredi <miklos@szeredi.hu> wrote:
>
> On Wed, Feb 12, 2020 at 8:58 AM Michael Stapelberg
> <michael+lkml@stapelberg.ch> wrote:
>
> > (gdb) p *req->args
> > $5 = {
> > nodeid = 18446683600620026424,
> > opcode = 2167928246,
> > in_numargs = 65535,
> > out_numargs = 65535,
> > force = false,
> > noreply = false,
> > nocreds = false,
> > in_pages = false,
> > out_pages = false,
> > out_argvar = true,
> > page_zeroing = true,
> > page_replace = false,
> > in_args = {{
> > size = 978828800,
> > value = 0x2fafce0
> > }, {
> > size = 978992728,
> > value = 0xffffffff8138efaa <fuse_alloc_forget+26>
> > }, {
> > size = 50002688,
> > value = 0xffffffff8138635f <fuse_lookup_name+255>
> > }},
> > out_args = {{
> > size = 570,
> > value = 0xffffc90002fafb10
> > }, {
> > size = 6876,
> > value = 0x3000000001adc
> > }},
> > end = 0x1000100000001
> > }
>
> Okay, that looks like rubbish, the request was possibly freed and overwritten.
>
> > Independently, as a separate test, I have also modified the source like this:
> >
> > bool async;
> > bool async_early = req->args->end;
> >
> > if (test_and_set_bit(FR_FINISHED, &req->flags))
> > goto put_request;
> >
> > async = req->args->end;
> >
> > …and printed the value of async and async_early. async is true,
> > async_early is false.
>
> Can you save and print out the value of req->opcode before the
> test_and_set_bit()?
>
> Thanks,
> Miklos
next prev parent reply other threads:[~2020-02-12 9:38 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-05 1:15 Still a pretty bad time on 5.4.6 with fuse_request_end Kyle Sanderson
2020-01-05 8:08 ` Greg KH
2020-01-16 11:06 ` Miklos Szeredi
2020-02-09 8:09 ` michael+lkml
2020-02-11 10:55 ` Miklos Szeredi
2020-02-12 7:58 ` Michael Stapelberg
2020-02-12 8:34 ` Miklos Szeredi
2020-02-12 9:38 ` Michael Stapelberg [this message]
2020-02-12 19:36 ` Miklos Szeredi
2020-02-13 7:23 ` Michael Stapelberg
2020-03-10 18:07 ` Vivek Goyal
2020-03-06 9:31 Bruno Thomsen
2020-03-09 19:03 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANnVG6=s1C7LSDGD1-Ato-sfaKi1LQvW3GM5wfAiUqWXibEohw@mail.gmail.com' \
--to=michael+lkml@stapelberg.ch \
--cc=fuse-devel@lists.sourceforge.net \
--cc=gregkh@linuxfoundation.org \
--cc=kyle.leet@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).