Re: [PATCH] Bug in 2.4.5 in proc_pid_make_inode ()

Re: [PATCH] Bug in 2.4.5 in proc_pid_make_inode ()

[Ulrich Weigand]

Martin Wilck wrote:

>I have recently experienced a number of kernel OOPSes
>in "top" under heavy load. Kernel is 2.4.5 (IA64, but
>this has nothing to do the IA64 patch).

Same here; I just debugged these on S/390 ...

>I have seen 2.4.6-pre6 contains changes to this subroutine as well,
>but they seem to be attacking a different problem.
>Having analyzed the stack trace and the kernel code with objdump,
>I am pretty certain that the changes in 2.4.6-pre6 do not fix my problem
>(if they did, I would see a crash in proc_pid_delete_inode rather
>than in proc_delete_inode).

I think the -pre6 code should be OK.  Note that the crash in
proc_delete_inode() occurs because the pointer to the parent
proc_dir_entry (which is taken from inode->u.generic_ip) is
non-zero.

In 2.4.5, this is the case because proc_pid_make_inode
assigns a value to inode->u.proc_i.task before calling iput().
That field overlays inode->u.generic_ip ...

In the 2.4.6-pre patches, the test for a zero pid is moved to
*before* assigning to inode->u.proc_i.task.  Therefore, when
iput calls proc_delete_inode(), the 'de' pointer will be
zero, and nothing will happen.

Whether this is particularly pretty is debateable, but it
appears to be correct.


Mit freundlichen Gruessen / Best Regards

Ulrich Weigand

--
  Dr. Ulrich Weigand
  Linux for S/390 Design & Development
  IBM Deutschland Entwicklung GmbH, Schoenaicher Str. 220, 71032 Boeblingen
  Phone: +49-7031/16-3727   ---   Email: Ulrich.Weigand@de.ibm.com

Re: [PATCH] Bug in 2.4.5 in proc_pid_make_inode ()

[Alexander Viro]

On Thu, 28 Jun 2001, Martin Wilck wrote:

> Hi,
> 
> I have recently experienced a number of kernel OOPSes
> in "top" under heavy load. Kernel is 2.4.5 (IA64, but
> this has nothing to do the IA64 patch).
> 
> The OOPS happens in the call tree
> 
> open () system call
> [...]
> real_lookup ()
> proc_base_lookup ()
> proc_pid_make_inode ()
> iput ()
> proc_delete_inode () -> OOPS in __MOD_DEC_USE_COUNT

Known, had been already fixed in 2.4.6-pre3.

[PATCH] Bug in 2.4.5 in proc_pid_make_inode ()

[Martin Wilck]

Hi,

I have recently experienced a number of kernel OOPSes
in "top" under heavy load. Kernel is 2.4.5 (IA64, but
this has nothing to do the IA64 patch).

The OOPS happens in the call tree

open () system call
[...]
real_lookup ()
proc_base_lookup ()
proc_pid_make_inode ()
iput ()
proc_delete_inode () -> OOPS in __MOD_DEC_USE_COUNT

proc_pid_make_inode () calls iput () if it finds a task PID of 0
(jump to label out_unlock). If (PID == 0), the statement

	inode->i_ino = fake_ino(task->pid, ino);

sets    inode->i_ino = ((0 << 16) | ino) = ino.

Thus if (ino < (1 << 16)), the test

	if (PROC_INODE_PROPER(inode))

in proc_delete_inode () will fail, and proc_delete_inode will
erroneously assume this is a non-PID inode and
look for a proc_dir_entry struct which is of course bogus
(the OOPS happens when it tries to decrement the module use counter).

Therefore I propose the following patch:

--- 2.4.5mw/fs/proc/base.c.org	Wed Jun 27 12:36:18 2001
+++ 2.4.5mw/fs/proc/base.c	Thu Jun 28 20:52:22 2001
@@ -672,6 +672,8 @@
 	return inode;

 out_unlock:
+	/* Make sure proc_delete_inode does the right thing */
+	inode->i_ino |= (1 << 16);
 	iput(inode);
 	return NULL;
 }

This will tell proc_delete_inode that this is a PID entry.

PS:
I have seen 2.4.6-pre6 contains changes to this subroutine as well,
but they seem to be attacking a different problem.
Having analyzed the stack trace and the kernel code with objdump,
I am pretty certain that the changes in 2.4.6-pre6 do not fix my problem
(if they did, I would see a crash in proc_pid_delete_inode rather
than in proc_delete_inode).

The two patches are not in conflict.

Regards,
Martin

-- 
Martin Wilck     <Martin.Wilck@fujitsu-siemens.com>
FSC EP PS DS1, Paderborn      Tel. +49 5251 8 15113