From: Sasha Levin <levinsasha928@gmail.com>
To: Ming Lei <tom.leiming@gmail.com>
Cc: Hillf Danton <dhillf@gmail.com>, Dave Jones <davej@redhat.com>,
Greg Kroah-Hartman <greg@kroah.com>,
Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: use after free in sysfs_find_dirent
Date: Sun, 17 Mar 2013 10:24:54 -0400 [thread overview]
Message-ID: <5145D236.70203@gmail.com> (raw)
In-Reply-To: <CACVXFVOKi=wKsLP850XJ95P=e1B2z+CP=t0GATCZL0gNDOCwnA@mail.gmail.com>
On 03/16/2013 09:02 PM, Ming Lei wrote:
> On Sun, Mar 17, 2013 at 2:33 AM, Sasha Levin <levinsasha928@gmail.com> wrote:
>>
>> I don't think it shows what we want it to show thought:
>>
>> [ 327.416905] Pid: 10504, comm: trinity-child98 Tainted: G W 3.9.0-rc2-next-20130315-sasha-00046-gecde602-dirty #301
>> [ 327.418815] Call Trace:
>> [ 327.419255] [<ffffffff812f880e>] release_sysfs_dirent+0x4e/0x120
>> [ 327.420595] [<ffffffff812f89d2>] sysfs_dir_pos+0x92/0x130
>> [ 327.421608] [<ffffffff812f8b8d>] sysfs_readdir+0x11d/0x280
>> [ 327.422562] [<ffffffff8128b070>] ? SyS_ioctl+0xa0/0xa0
>> [ 327.423441] [<ffffffff8128b070>] ? SyS_ioctl+0xa0/0xa0
>> [ 327.424314] [<ffffffff8128b3e8>] vfs_readdir+0x78/0xc0
>> [ 327.425263] [<ffffffff8128b54c>] SyS_getdents+0x8c/0x110
>> [ 327.426173] [<ffffffff83d919d8>] tracesys+0xe1/0xe6
>>
>
> Sasha, looks there is a race when sys_readdir() is run concurrently
> on same directory, and the below patch may fix the race, could you test the
> attachment patch to see if the use after free can be fixed?
I still see it going on with the patch applied:
[ 521.881968] release_sysfs_dirent sysfs_dirent use after free: altera_jtaguart-bind
[ 521.883202] Pid: 29624, comm: trinity-child51 Tainted: G W 3.9.0-rc2-next-20130315-sasha-00046-gecde602-dirty #302
[ 521.885030] Call Trace:
[ 521.885503] [<ffffffff812f880e>] release_sysfs_dirent+0x4e/0x120
[ 521.886559] [<ffffffff812f89d2>] sysfs_dir_pos+0x92/0x130
[ 521.887514] [<ffffffff812f8bd4>] sysfs_readdir+0x164/0x2c0
[ 521.888403] [<ffffffff8128b170>] ? filldir+0x100/0x100
[ 521.889241] [<ffffffff8128b170>] ? filldir+0x100/0x100
[ 521.890222] [<ffffffff8128b3e8>] vfs_readdir+0x78/0xc0
[ 521.891028] [<ffffffff8117999d>] ? trace_hardirqs_on+0xd/0x10
[ 521.891976] [<ffffffff8128b660>] SyS_getdents64+0x90/0x120
[ 521.892831] [<ffffffff83d91a18>] tracesys+0xe1/0xe6
[ 526.910352] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 526.911625] Dumping ftrace buffer:
[ 526.912158] (ftrace buffer empty)
[ 526.912715] Modules linked in:
[ 526.913213] CPU 3
[ 526.913521] Pid: 374, comm: trinity-child86 Tainted: G W 3.9.0-rc2-next-20130315-sasha-00046-gecde602-dirty #302
[ 526.915342] RIP: 0010:[<ffffffff812f8a10>] [<ffffffff812f8a10>] sysfs_dir_pos+0xd0/0x130
[ 526.916622] RSP: 0018:ffff88008caa9e18 EFLAGS: 00010202
[ 526.917453] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8800b417d128 RCX: ffff8800b417cb70
[ 526.918525] RDX: 000000006b6b6b6b RSI: ffff8800b417c988 RDI: 0000000000000000
[ 526.919579] RBP: ffff88008caa9e48 R08: 2222222222222222 R09: 2222222222222222
[ 526.920058] R10: 2222222222222222 R11: 0000000000000000 R12: 0000000000000000
[ 526.920058] R13: 0000000049619f4a R14: ffff8800b417c988 R15: 0000000000000000
[ 526.920058] FS: 00007fd9e349b700(0000) GS:ffff8800bbe00000(0000) knlGS:0000000000000000
[ 526.920058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 526.920058] CR2: 0000000100000000 CR3: 0000000084c61000 CR4: 00000000000406e0
[ 526.920058] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 526.920058] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 526.920058] Process trinity-child86 (pid: 374, threadinfo ffff88008caa8000, task ffff880082a63000)
[ 526.920058] Stack:
[ 526.920058] ffff8800a4d26088 ffff88008dc7f180 ffff88008dc7f180 0000000000000000
[ 526.920058] ffff8800a4d26088 ffff8800a4d25fa0 ffff88008caa9eb8 ffffffff812f8bd4
[ 526.920058] 2222222222222222 2222222222222222 ffff88008caa9e98 ffffffff8128b170
[ 526.920058] Call Trace:
[ 526.920058] [<ffffffff812f8bd4>] sysfs_readdir+0x164/0x2c0
[ 526.920058] [<ffffffff8128b170>] ? filldir+0x100/0x100
[ 526.920058] [<ffffffff8128b170>] ? filldir+0x100/0x100
[ 526.920058] [<ffffffff8128b3e8>] vfs_readdir+0x78/0xc0
[ 526.920058] [<ffffffff8117999d>] ? trace_hardirqs_on+0xd/0x10
[ 526.920058] [<ffffffff8128b660>] SyS_getdents64+0x90/0x120
[ 526.920058] [<ffffffff83d91a18>] tracesys+0xe1/0xe6
[ 526.920058] Code: 44 00 00 48 85 db 74 6d 4c 39 63 68 75 45 eb 65 0f 1f 00 49 81 fd fe ff ff 7f 7f 59 49 8b 86 88 00 00 00 48
85 c0 74 4d 0f 1f 00 <8b> 50 28 48 8d 58 b8 49 39 d5 7d 0c 48 8b 40 10 eb 0c 66 0f 1f
[ 526.920058] RIP [<ffffffff812f8a10>] sysfs_dir_pos+0xd0/0x130
[ 526.920058] RSP <ffff88008caa9e18>
[ 526.946105] ---[ end trace ec3353999032c934 ]---
next prev parent reply other threads:[~2013-03-17 14:24 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-07 5:28 Dave Jones
2013-03-07 5:33 ` sysfs_dir_cache slab corruption Dave Jones
2013-03-07 6:03 ` Greg Kroah-Hartman
2013-03-07 6:02 ` use after free in sysfs_find_dirent Greg Kroah-Hartman
2013-03-07 6:26 ` Dave Jones
2013-03-13 11:47 ` Ming Lei
2013-03-15 4:03 ` Sasha Levin
2013-03-15 5:04 ` Sasha Levin
2013-03-15 7:38 ` Ming Lei
2013-03-15 16:27 ` Sasha Levin
2013-03-16 12:39 ` Hillf Danton
2013-03-16 13:30 ` Ming Lei
2013-03-16 15:07 ` Sasha Levin
2013-03-16 15:22 ` Ming Lei
2013-03-16 15:58 ` Ming Lei
2013-03-16 18:33 ` Sasha Levin
2013-03-17 1:02 ` Ming Lei
2013-03-17 14:24 ` Sasha Levin [this message]
2013-03-17 16:23 ` Ming Lei
2013-03-19 2:06 ` Sasha Levin
2013-03-19 3:40 ` Ming Lei
2013-03-19 11:54 ` Ming Lei
2013-03-19 16:28 ` Sasha Levin
2013-03-20 1:02 ` Ming Lei
2013-03-20 14:34 ` Sasha Levin
2013-03-20 17:17 ` Greg Kroah-Hartman
2013-03-16 15:59 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5145D236.70203@gmail.com \
--to=levinsasha928@gmail.com \
--cc=davej@redhat.com \
--cc=dhillf@gmail.com \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tom.leiming@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome