mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* Re: OOPS[devfs]: reproducible in vfs_follow_link 2.4.9,2.4.10-pre4
@ 2001-09-10  7:59 Giacomo Catenazzi
  0 siblings, 0 replies; 4+ messages in thread
From: Giacomo Catenazzi @ 2001-09-10  7:59 UTC (permalink / raw)
  To: Richard Gooch; +Cc: Alexander Viro, linux-kernel

Richard Gooch wrote:

> Giacomo A. Catenazzi writes:
>>Richard Gooch wrote:
>>>Alexander Viro writes:
>>>>On Thu, 6 Sep 2001, Giacomo Catenazzi wrote:
>>>>>
>>>>>Since yesterdey, every time I run a 2.4.9 or 2.4.10pre-4 without
the
>>>>>"devfs=nomount" I
>>>>>have two oops + /usr, /home /boot not mounted (all (also /): ext2).
>>>>>
>>>>      Don't use devfs. One of the known bugs - devfs passes a string
>>>>to vfs_follow_link() and doesn't care to preserve it until
>>>>vfs_follow_link() is done.
>>>>
> [I said it was fixed for UP in recent devfs patches]
> 
>>>If people could test the latest devfs patch, that would be really
>>>helpful. Linus isn't applying it because he's concerned that the many
>>>SD support may break something. Even if you don't have many SD's,
>>>please apply the patch and send a message to the list (and Cc: me)
>>>stating whether or not your system still works.
>>>
>>No, your patch  didn't work.
>>I have still the oops.
>>
> 
> Hm! Is this a UP or SMP kernel?


UP

>>I investigates, and the oops come in the mountall script (in init.d),
>>when running: mount -avt nonfs,nosmbfs.
>>(I noticed thet at this point kernel load floppy modules, but when I
>>removed also the floppy module, the oops reappers.)
>>
> 
> Hm. I've had one other bug report which initially seemed to be
> devfs-related, but it was also related to the floppy driver as
> well. IIRC, elsewhere Alan noted there seemed to be some problems with
> the floppy driver. I suspect the bug you (and the other person) are
> having is related to the floppy driver and not devfs.
> 
> Please try renaming/removing your floppy driver and see if the problem
> persists. I bet it goes away. As Al mused, it was odd that the problem
> only appears now. While there are known races in devfs, no-one has
> ever encountered these in real life (targetted exploits are not "real
> life"). So I too am surprised that suddenly there appears a problem
> with devfs.


The causes seem be the bad interaction of devfs, floppy, mount and
devfsd.

After further investigations:
- Oops happens in 2.4.9, 10pre4 and 10pre5.
- devfs=nomount solve the bug
- the oops happens in mount (I should investigate also why mount load
the
    floppy module at boot time)
- removing floppy modules or comment the line in fstab solve the bug.
   (manually loading the floppy module works without oops)

The strange things:
the bugs appear only after few day of rebooting 2.4.9 and yet
is disappeard.
The possible change in environtment is the update (and then downgrade)
of devfsd (last version, only with with/without an extra patch, in
debian).
But updating and downgading seem not to cause oops at the next boot.
(I should still better invetigate about this. Maybe the bug is
due to dev-state, thus the bug appear only after the 2 reboot?
)


In any case, I will invetigate more this night. Do you have some
suggestions about tests to do?

> 
> In the meantime, my tree is getting closer to the stage where I will
> attempt a compile. Soon I will be able to dispel this dark cloud of
> "devfs races" that Al keeps muttering about :-)


Ok, I'm waiting also for these changes!


		giacomo



^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: OOPS: reproducible in vfs_follow_link 2.4.9,2.4.10-pre4
  2001-09-06 13:04 ` Giacomo Catenazzi
@ 2001-09-06 19:10 Alexander Viro
  2001-09-06 13:04 ` Giacomo Catenazzi
  0 siblings, 1 reply; 4+ messages in thread
From: Alexander Viro @ 2001-09-06 19:10 UTC (permalink / raw)
  To: Giacomo Catenazzi; +Cc: linux-kernel



On Thu, 6 Sep 2001, Giacomo Catenazzi wrote:

> Hello.
> 
> Since yesterdey, every time I run a 2.4.9 or 2.4.10pre-4 without the 
> "devfs=nomount" I
> have two oops + /usr, /home /boot not mounted (all (also /): ext2).

	Don't use devfs. One of the known bugs - devfs passes a string to
vfs_follow_link() and doesn't care to preserve it until vfs_follow_link()
is done.

E.g. rmmod during the symlink traversal will end up with

vfs_follow_link(nd, s)
[working]
[blocked on IO/allocation/whatever]
rmmod
...
kfree(s)
...
[the first process wakes up and oopses on attempt to dereference s]

	There are other scenarios that end up freeing a string passed to
vfs_follow_link() (or, for that matter, being busily copied to userland by
readlink(2)).  Basically, if devfs decides that symlink is gone - pray.
If it's being accessed right now you are going to end up with oops.

	No idea why you've started triggering it only now - not enough
details to say.

	And yes, Richard had been informed about that months ago. Sigh...


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2001-09-10  8:02 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2001-09-10  7:59 OOPS[devfs]: reproducible in vfs_follow_link 2.4.9,2.4.10-pre4 Giacomo Catenazzi
  -- strict thread matches above, loose matches on Subject: below --
2001-09-06 19:10 OOPS: " Alexander Viro
2001-09-06 13:04 ` Giacomo Catenazzi
2001-09-06 19:41   ` OOPS[devfs]: " Richard Gooch
2001-09-07 19:33     ` Richard Gooch
2001-09-07 20:45     ` Giacomo A. Catenazzi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®