From: Jens Axboe <axboe@fb.com>
To: Vegard Nossum <vegard.nossum@oracle.com>
Cc: <linux-kernel@vger.kernel.org>, <syzkaller@googlegroups.com>,
Shaohua Li <shli@fb.com>, Tejun Heo <tj@kernel.org>,
<stable@vger.kernel.org>
Subject: Re: [PATCH] bdev: fix NULL pointer dereference
Date: Mon, 22 Aug 2016 08:06:32 -0600 [thread overview]
Message-ID: <858239cb-4b97-c071-2317-7e6da11675ac@fb.com> (raw)
In-Reply-To: <20160822104743.16077-1-vegard.nossum@oracle.com>
On 08/22/2016 04:47 AM, Vegard Nossum wrote:
> I got this:
>
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> CPU: 0 PID: 5505 Comm: syz-executor Not tainted 4.8.0-rc2+ #161
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
> task: ffff880113415940 task.stack: ffff880118350000
> RIP: 0010:[<ffffffff8172cb32>] [<ffffffff8172cb32>] bd_mount+0x52/0xa0
> RSP: 0018:ffff880118357ca0 EFLAGS: 00010207
> RAX: dffffc0000000000 RBX: ffffffffffffffff RCX: ffffc90000bb6000
> RDX: 0000000000000018 RSI: ffffffff846d6b20 RDI: 00000000000000c7
> RBP: ffff880118357cb0 R08: ffff880115967c68 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801188211e8
> R13: ffffffff847baa20 R14: ffff8801139cb000 R15: 0000000000000080
> FS: 00007fa3ff6c0700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fc1d8cc7e78 CR3: 0000000109f20000 CR4: 00000000000006f0
> DR0: 000000000000001e DR1: 000000000000001e DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> Stack:
> ffff880112cfd6c0 ffff8801188211e8 ffff880118357cf0 ffffffff8167f207
> ffffffff816d7a1e ffff880112a413c0 ffffffff847baa20 ffff8801188211e8
> 0000000000000080 ffff880112cfd6c0 ffff880118357d38 ffffffff816dce0a
> Call Trace:
> [<ffffffff8167f207>] mount_fs+0x97/0x2e0
> [<ffffffff816d7a1e>] ? alloc_vfsmnt+0x55e/0x760
> [<ffffffff816dce0a>] vfs_kern_mount+0x7a/0x300
> [<ffffffff83c3247c>] ? _raw_read_unlock+0x2c/0x50
> [<ffffffff816dfc87>] do_mount+0x3d7/0x2730
> [<ffffffff81235fd4>] ? trace_do_page_fault+0x1f4/0x3a0
> [<ffffffff816df8b0>] ? copy_mount_string+0x40/0x40
> [<ffffffff8161ea81>] ? memset+0x31/0x40
> [<ffffffff816df73e>] ? copy_mount_options+0x1ee/0x320
> [<ffffffff816e2a02>] SyS_mount+0xb2/0x120
> [<ffffffff816e2950>] ? copy_mnt_ns+0x970/0x970
> [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
> [<ffffffff83c3282a>] entry_SYSCALL64_slow_path+0x25/0x25
> Code: 83 e8 63 1b fc ff 48 85 c0 48 89 c3 74 4c e8 56 35 d1 ff 48 8d bb c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 36 4c 8b a3 c8 00 00 00 48 b8 00 00 00 00 00 fc
> RIP [<ffffffff8172cb32>] bd_mount+0x52/0xa0
> RSP <ffff880118357ca0>
> ---[ end trace 13690ad962168b98 ]---
>
> mount_pseudo() returns ERR_PTR(), not NULL, on error.
Thanks, applied.
--
Jens Axboe
prev parent reply other threads:[~2016-08-22 14:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-22 10:47 Vegard Nossum
2016-08-22 14:06 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=858239cb-4b97-c071-2317-7e6da11675ac@fb.com \
--to=axboe@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=shli@fb.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=tj@kernel.org \
--cc=vegard.nossum@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®