pstore: do not use message compression without lock
PATCH 1/1 pstore: do not use message compression without lock
pstore_compress() uses static stream buffer for zlib-deflate which easily crashes when several concurrent threads use one shared state.
Signed-off-by Konstantin Khlebnikov <[email protected]>
--- fs/pstore/platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/pstore/platform.c +1 -1
@@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,bool compressed;size_t total_len; -if (big_oops_buf) { +if (big_oops_buf && is_locked) { dst = big_oops_buf; hsize =sprintf (dst,"%s#%d Part%u\n" , why, oopscount, part);
Quoted 14 lines · Konstantin Khlebnikov
pstore_compress()uses static stream buffer for zlib-deflate which easily crashes when several concurrent threads use one shared state.Signed-off-by Konstantin Khlebnikov <[email protected]>--- fs/pstore/platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)fs/pstore/platform.c +0
-0
fs/pstore/platform.c static void pstore_dump(struct kmsg_dumper *dumper, · line 305
Quoted 8 lines
fs/pstore/platform.c +1
-1@@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,bool compressed;size_t total_len; -if (big_oops_buf) { +if (big_oops_buf && is_locked) { dst = big_oops_buf; hsize =sprintf (dst,"%s#%d Part%u\n" , why, oopscount, part);
Bump
Example of crash:
<1>[ 3579.939946] BUG: unable to handle kernel paging request at 0000000081eea3dc <1>[ 3579.939951] IP: [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130 <4>[ 3579.939953] PGD 0 <4>[ 3579.939954] Oops: 0000 [#1] SMP <4>[ 3579.939970] Modules linked in: netconsole configfs 8021q mrp garp stp llc x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm crc32_pclmul ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 microcode sb_edac edac_core ipmi_si ipmi_msghandler ast ttm drm_kms_helper drm sysimgblt sysfillrect syscopyarea lpc_ich mlx4_en mlx4_core vxlan udp_tunnel ip6_udp_tunnel tcp_htcp igb dca i2c_algo_bit isci i2c_core ptp libsas ahci pps_core scsi_transport_sas libahci raid10 raid456 async_pq async_xor xor async_memcpy async_raid6_recov raid6_pq async_tx raid1 raid0 multipath linear <4>[ 3579.939972] CPU: 12 PID: 0 Comm: swapper/12 Tainted: G W 3.18.11-11 #4 <4>[ 3579.939974] task: ffff883fd2e4baa0 ti: ffff881fd31fc000 task.ti: ffff881fd31fc000 <4>[ 3579.939976] RIP: 0010:[<ffffffff81382274>] [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130 <4>[ 3579.939976] RSP: 0018:ffff88407fc86ae8 EFLAGS: 00010016 <4>[ 3579.939977] RAX: 000000000000006c RBX: ffff881fd0080000 RCX: ffff881fd0087348 <4>[ 3579.939978] RDX: 00000000fffffffc RSI: 000000000000003f RDI: ffff881fd0080000 <4>[ 3579.939978] RBP: ffff88407fc86ae8 R08: 000000000000006d R09: 0000000000000041 <4>[ 3579.939978] R10: ffff881fd0081748 R11: 0000000000000000 R12: 0000000000000577 <4>[ 3579.939979] R13: 0000000000003ae1 R14: 0000000000000005 R15: ffff881fd00700c8 <4>[ 3579.939980] FS: 0000000000000000(0000) GS:ffff88407fc80000(0000) knlGS:0000000000000000 <4>[ 3579.939980] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 3579.939981] CR2: 0000000081eea3dc CR3: 0000000001c14000 CR4: 00000000001407e0 <4>[ 3579.939981] Stack: <4>[ 3579.939982] ffff88407fc86b18 ffffffff8137ef38 ffff881fd0080000 ffffffff81ee4340 <4>[ 3579.939983] 0000000000000005 0000000000000f00 ffff88407fc86b48 ffffffff8137fa23 <4>[ 3579.939984] ffff883fcff90000 0000000000000010 0000000000000002 0000000000000fc1 <4>[ 3579.939985] Call Trace: <4>[ 3579.939986] <NMI> <4>[ 3579.939987] [<ffffffff8137ef38>] deflate_slow+0x218/0x420 <4>[ 3579.939989] [<ffffffff8137fa23>] zlib_deflate+0xc3/0x400 <4>[ 3579.939993] [<ffffffff812de50e>] pstore_dump+0x26e/0x410 <4>[ 3579.939997] [<ffffffff810b0da7>] kmsg_dump+0x127/0x160 <4>[ 3579.939998] [<ffffffff810febe2>] watchdog_overflow_callback+0xa2/0xc0 <4>[ 3579.940001] [<ffffffff8113a3a8>] __perf_event_overflow+0x98/0x230 <4>[ 3579.940004] [<ffffffff8102c34a>] ? x86_perf_event_set_period+0xda/0x150 <4>[ 3579.940005] [<ffffffff8113ae04>] perf_event_overflow+0x14/0x20 <4>[ 3579.940007] [<ffffffff810338c9>] intel_pmu_handle_irq+0x1d9/0x3c0 <4>[ 3579.940009] [<ffffffff81182641>] ? unmap_kernel_range_noflush+0x11/0x20 <4>[ 3579.940011] [<ffffffff813f9768>] ? ghes_copy_tofrom_phys+0x118/0x1f0 <4>[ 3579.940013] [<ffffffff8102b694>] perf_event_nmi_handler+0x34/0x60 <4>[ 3579.940014] [<ffffffff81018b9a>] nmi_handle+0x8a/0x150 <4>[ 3579.940016] [<ffffffff813fa600>] ? ghes_print_estatus.constprop.12+0x70/0x70 <4>[ 3579.940017] [<ffffffff81019266>] default_do_nmi+0x56/0x160 <4>[ 3579.940018] [<ffffffff81019400>] do_nmi+0x90/0xd0 <4>[ 3579.940020] [<ffffffff816d34e1>] end_repeat_nmi+0x1e/0x2e <4>[ 3579.940023] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150 <4>[ 3579.940024] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150 <4>[ 3579.940026] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150 <4>[ 3579.940027] <<EOE>> <4>[ 3579.940029] [<ffffffff81574787>] cpuidle_enter_state+0x57/0x1d0 <4>[ 3579.940030] [<ffffffff815749c7>] cpuidle_enter+0x17/0x20 <4>[ 3579.940032] [<ffffffff810a893f>] cpu_startup_entry+0x34f/0x3d0 <4>[ 3579.940034] [<ffffffff810cd772>] ? clockevents_register_device+0xe2/0x140 <4>[ 3579.940036] [<ffffffff8104632c>] start_secondary+0x14c/0x160 <4>[ 3579.940046] Code: 1f 84 00 00 00 00 00 8b 87 f0 16 00 00 83 e8 01 41 39 c0 0f 94 c0 0f b6 c0 5d c3 0f 1f 40 00 89 d2 83 87 18 17 00 00 01 83 ee 01 <0f> b6 82 e0 a3 ee 81 66 83 84 87 c0 04 00 00 01 81 fe ff 00 00 <1>[ 3579.940047] RIP [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130 <4>[ 3579.940048] RSP <ffff88407fc86ae8> <4>[ 3579.940048] CR2: 0000000081eea3dc
Signature · 1 line
Konstantin
Luck, Tony
reviewerQuoted 6 lines
fs/pstore/platform.c +1
-1-if (big_oops_buf) { +if (big_oops_buf && is_locked) { dst = big_oops_buf; hsize = sprintf(dst, "%s#%d Part%u\n", why,Bump
Thanks for the reminder. Applied. Should show up in linux-next soon, and then go to Linus in next merge window
-Tony ���{.n�+�������+%�����ݶ��w��{.n�+����{��G�����{ay� ʇڙ�,j��f���h��������z_�(�階�ݢj"���m������G������?����&���~��iO��z��v�^�m���� ������?�I�