Skip to contentSkip to conversation

WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()

DISCUSSION Toralf Förster 3 participants 16 messages May 10, 2013 – May 11, 2013

Subsystems (5)
Memory management VFS MM core User-mode Linux (UML) +1 more subsystems
lore
Share & tools
lore

Toralf Förster

author
#0 lore raw

The bisected commit introduced this WARNING: on a user mode linux guest if the UML guest is fuzz tested with trinity :

2013-05-10T22:38:42.191+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-10T22:38:42.191+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fda8:  [<08336928>] dump_stack+0x22/0x24
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdc0:  [<0807c2da>] warn_slowpath_common+0x5a/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fde8:  [<0807c3a3>] warn_slowpath_null+0x23/0x30
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdf8:  [<080dfc93>] kmalloc_slab+0x33/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe0c:  [<080f8beb>] __kmalloc_track_caller+0x1b/0x110
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe30:  [<080dc866>] memdup_user+0x26/0x70
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe4c:  [<080dca6e>] strndup_user+0x3e/0x60
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe68:  [<0811ba60>] copy_mount_string+0x30/0x50
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fe7c:  [<0811c46a>] sys_mount+0x1a/0xe0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2feac:  [<08062b32>] handle_syscall+0x82/0xb0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fef4:  [<0807520d>] userspace+0x46d/0x590
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2ffec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fffc:  [<00000000>] 0x0
2013-05-10T22:38:42.195+02:00 trinity kernel:
2013-05-10T22:38:42.195+02:00 trinity kernel: ---[ end trace 17e5931469d0697d ]---

Tested with host kernel 3.9.1, host and client were 32bit stable Gentoo Linux.

6286ae97d10ea2b5cd90532163797ab217bfdbdf is the first bad commit commit 6286ae97d10ea2b5cd90532163797ab217bfdbdf

Author: Christoph Lameter <[email protected]>
Date:   Fri May 3 15:43:18 2013 +0000

slab: Return NULL for oversized allocations

The inline path seems to have changed the SLAB behavior for very large kmalloc allocations with commit e3366016 ("slab: Use common kmalloc_index/kmalloc_size functions"). This patch restores the old behavior but also adds diagnostics so that we can figure where in the code these large allocations occur.

Reported-and-tested-by Tetsuo Handa <[email protected]>
Signed-off-by Christoph Lameter <[email protected]>
Link http://lkml.kernel.org/r/[email protected] open here
[ [email protected]: use WARN_ON_ONCE ]
Signed-off-by Pekka Enberg <[email protected]>

-- MfG/Sincerely
Toralf FA?rster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

author
#1 lore raw
Quoted 2 lines · Toralf FA?rster

The bisected commit introduced this WARNING: on a user mode linux guest if the UML guest is fuzz tested with trinity :

Well, the behaviour is much older, a test with an UML guest kernel 3.7.10 showed a similar thing :
Sry for the noise.

2013-05-11T10:16:30.841+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-11T10:16:30.841+02:00 trinity kernel: WARNING: at mm/page_alloc.c:2384 __alloc_pages_nodemask+0x13c/0x740()
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7d10:  [<08332bd8>] dump_stack+0x22/0x24
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7d28:  [<0807d6ca>] warn_slowpath_common+0x5a/0x80
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7d50:  [<0807d793>] warn_slowpath_null+0x23/0x30
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7d60:  [<080d43ac>] __alloc_pages_nodemask+0x13c/0x740
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7df0:  [<080d49d8>] __get_free_pages+0x28/0x50
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7e08:  [<080fc28d>] __kmalloc_track_caller+0x3d/0x170
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7e30:  [<080dfbe6>] memdup_user+0x26/0x70
2013-05-11T10:16:30.841+02:00 trinity kernel: 3fda7e4c:  [<080dfdee>] strndup_user+0x3e/0x60
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7e68:  [<0811ae70>] copy_mount_string+0x30/0x50
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7e7c:  [<0811b6ba>] sys_mount+0x1a/0xe0
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7eac:  [<08062c32>] handle_syscall+0x82/0xb0
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7ef4:  [<0807503d>] userspace+0x46d/0x590
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7fec:  [<0805f80c>] fork_handler+0x6c/0x70
2013-05-11T10:16:30.856+02:00 trinity kernel: 3fda7ffc:  [<00000000>] 0x0
2013-05-11T10:16:30.856+02:00 trinity kernel:
2013-05-11T10:16:30.856+02:00 trinity kernel: ---[ end trace db5193a4984ce93f ]---
Signature · 9 lines
MfG/Sincerely
Toralf FA?rster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
#2 lore raw
In reply to Toralf Förster
Quoted 39 lines · Toralf Förster

The bisected commit introduced this WARNING: on a user mode linux guest if the UML guest is fuzz tested with trinity :

2013-05-10T22:38:42.191+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-10T22:38:42.191+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fda8:  [<08336928>] dump_stack+0x22/0x24
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdc0:  [<0807c2da>] warn_slowpath_common+0x5a/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fde8:  [<0807c3a3>] warn_slowpath_null+0x23/0x30
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdf8:  [<080dfc93>] kmalloc_slab+0x33/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe0c:  [<080f8beb>] __kmalloc_track_caller+0x1b/0x110
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe30:  [<080dc866>] memdup_user+0x26/0x70
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe4c:  [<080dca6e>] strndup_user+0x3e/0x60
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe68:  [<0811ba60>] copy_mount_string+0x30/0x50
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fe7c:  [<0811c46a>] sys_mount+0x1a/0xe0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2feac:  [<08062b32>] handle_syscall+0x82/0xb0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fef4:  [<0807520d>] userspace+0x46d/0x590
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2ffec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fffc:  [<00000000>] 0x0
2013-05-10T22:38:42.195+02:00 trinity kernel:
2013-05-10T22:38:42.195+02:00 trinity kernel: ---[ end trace 17e5931469d0697d ]---

Tested with host kernel 3.9.1, host and client were 32bit stable Gentoo Linux.

6286ae97d10ea2b5cd90532163797ab217bfdbdf is the first bad commit commit 6286ae97d10ea2b5cd90532163797ab217bfdbdf

Author: Christoph Lameter <[email protected]>
Date:   Fri May 3 15:43:18 2013 +0000

slab: Return NULL for oversized allocations

The inline path seems to have changed the SLAB behavior for very large kmalloc allocations with commit e3366016 ("slab: Use common kmalloc_index/kmalloc_size functions"). This patch restores the old behavior but also adds diagnostics so that we can figure where in the code these large allocations occur.

Quoted 6 lines
Reported-and-tested-by Tetsuo Handa <[email protected]>
Signed-off-by Christoph Lameter <[email protected]>
Link http://lkml.kernel.org/r/[email protected] open here
[ [email protected]: use WARN_ON_ONCE ]
Signed-off-by Pekka Enberg <[email protected]>

So, we trigger "if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))". Now I'm wondering what kind of argument string trinity gave to mount(). How long is it?

BTW: Toralf, why are you sending this to user-mode-linux-*user*@lists...? We also have a -devel list. Please at least CC me.
Otherwise it is most likely that I miss such reports...

--
Thanks,
//richard

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

author
#3 lore raw

Dave,

can you pls answer to Richards question:

So, we trigger "if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))". Now I'm wondering what kind of argument string trinity gave to mount(). How long is it?

-------- Original Message --------
Subject: Re: [uml-user] WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
Date: Sat, 11 May 2013 10:20:05 +0200
From: richard -rw- weinberger <[email protected]>
To: Toralf Förster <[email protected]>
CC: [email protected] <[email protected]>, [email protected] <[email protected]>

Quoted 39 lines · Toralf Förster

The bisected commit introduced this WARNING: on a user mode linux guest if the UML guest is fuzz tested with trinity :

2013-05-10T22:38:42.191+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-10T22:38:42.191+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fda8:  [<08336928>] dump_stack+0x22/0x24
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdc0:  [<0807c2da>] warn_slowpath_common+0x5a/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fde8:  [<0807c3a3>] warn_slowpath_null+0x23/0x30
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fdf8:  [<080dfc93>] kmalloc_slab+0x33/0x80
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe0c:  [<080f8beb>] __kmalloc_track_caller+0x1b/0x110
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe30:  [<080dc866>] memdup_user+0x26/0x70
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe4c:  [<080dca6e>] strndup_user+0x3e/0x60
2013-05-10T22:38:42.191+02:00 trinity kernel: 40e2fe68:  [<0811ba60>] copy_mount_string+0x30/0x50
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fe7c:  [<0811c46a>] sys_mount+0x1a/0xe0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2feac:  [<08062b32>] handle_syscall+0x82/0xb0
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fef4:  [<0807520d>] userspace+0x46d/0x590
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2ffec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-10T22:38:42.195+02:00 trinity kernel: 40e2fffc:  [<00000000>] 0x0
2013-05-10T22:38:42.195+02:00 trinity kernel:
2013-05-10T22:38:42.195+02:00 trinity kernel: ---[ end trace 17e5931469d0697d ]---

Tested with host kernel 3.9.1, host and client were 32bit stable Gentoo Linux.

6286ae97d10ea2b5cd90532163797ab217bfdbdf is the first bad commit commit 6286ae97d10ea2b5cd90532163797ab217bfdbdf

Author: Christoph Lameter <[email protected]>
Date:   Fri May 3 15:43:18 2013 +0000

slab: Return NULL for oversized allocations

The inline path seems to have changed the SLAB behavior for very large kmalloc allocations with commit e3366016 ("slab: Use common kmalloc_index/kmalloc_size functions"). This patch restores the old behavior but also adds diagnostics so that we can figure where in the code these large allocations occur.

Quoted 6 lines
Reported-and-tested-by Tetsuo Handa <[email protected]>
Signed-off-by Christoph Lameter <[email protected]>
Link http://lkml.kernel.org/r/[email protected] open here
[ [email protected]: use WARN_ON_ONCE ]
Signed-off-by Pekka Enberg <[email protected]>

So, we trigger "if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))". Now I'm wondering what kind of argument string trinity gave to mount(). How long is it?

BTW: Toralf, why are you sending this to user-mode-linux-*user*@lists...? We also have a -devel list. Please at least CC me.
Otherwise it is most likely that I miss such reports...

--
Thanks,
//richard

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#4 lore raw
Quoted 8 lines · Toralf Förster

Dave,

can you pls answer to Richards question:

So, we trigger "if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))". Now I'm wondering what kind of argument string trinity gave to mount(). How long is it?

Hehe, it's not that easy.
We have to find out.
Can you please add a printk() into copy_mount_string() which prints out the string size?

--
Thanks,
//richard

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

author
#5 lore raw
Quoted 6 lines · richard -rw- weinberger
Quoted 5 lines · Toralf Förster

Dave,

can you pls answer to Richards question:

Quoted 8 lines
Quoted 3 lines

So, we trigger "if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))". Now I'm wondering what kind of argument string trinity gave to mount(). How long is it?

Hehe, it's not that easy.
We have to find out.
Can you please add a printk() into copy_mount_string() which prints out the string size?

With this change:

fs/namespace.c +2 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
 
+       printk(" here: size is %ul\n", (unsigned long)data);
+
        tmp = strndup_user(data, PAGE_SIZE);
        if (IS_ERR(tmp))
                return PTR_ERR(tmp);
Quoted 5 lines

--
Thanks,
//richard

I get :

2013-05-11T11:51:00.551+02:00 trinity kernel: Adding 262140k swap on /dev/mapper/crypt-swap.  Priority:-1 extents:1 across:262140k FS
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134565664l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134565632l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134564296l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134564312l
2013-05-11T11:51:00.000+02:00 trinity haveged: haveged starting up
2013-05-11T11:51:00.000+02:00 trinity haveged: haveged: Completed tot procedure B after 1172535 bytes
2013-05-11T11:51:01.000+02:00 trinity haveged: haveged: Completed tot procedure A after 1035716 bytes
2013-05-11T11:51:01.000+02:00 trinity haveged: haveged: version: 1.5; arch: x86; vendor: GenuineIntel; cores: 1/1, buffer: 128
2013-05-11T11:51:01.000+02:00 trinity haveged: haveged: d_cache: 32K (000020), i_cache: 32K (000020), i_index: 19/40, i_size: 32653/60731
2013-05-11T11:51:01.000+02:00 trinity haveged: haveged: tot tests: BA8, continuous tests: B
2013-05-11T11:51:01.000+02:00 trinity dhcpcd[777]: version 5.6.4 starting
2013-05-11T11:51:01.000+02:00 trinity dhcpcd[777]: ipv6_open: Address family not supported by protocol
2013-05-11T11:51:01.000+02:00 trinity haveged: haveged: Completed continuous procedure B after 1172535 bytes
2013-05-11T11:51:01.000+02:00 trinity dhcpcd[777]: eth0: rebinding lease of 192.168.1.63
2013-05-11T11:51:01.000+02:00 trinity dhcpcd[777]: eth0: acknowledged 192.168.1.63 from 192.168.0.254
2013-05-11T11:51:01.000+02:00 trinity dhcpcd[777]: eth0: checking for 192.168.1.63
2013-05-11T11:51:06.000+02:00 trinity dhcpcd[777]: eth0: leased 192.168.1.63 for infinity
2013-05-11T11:51:07.000+02:00 trinity dhcpcd[777]: forked to background, child pid 811
2013-05-11T11:51:09.000+02:00 trinity cron[855]: (CRON) STARTUP (V5.0)
2013-05-11T11:51:10.097+02:00 trinity kernel: Virtual console 1 assigned device '/dev/pts/6'
2013-05-11T11:51:14.000+02:00 trinity sshd[874]: pam_unix(sshd:session): session opened for user tfoerste by (uid=0)
2013-05-11T11:51:16.344+02:00 trinity kernel: here: size is 139336544l
2013-05-11T11:51:16.344+02:00 trinity kernel: here: size is 139435704l
2013-05-11T11:51:16.478+02:00 trinity kernel: here: size is 135065600l
2013-05-11T11:51:16.478+02:00 trinity kernel: here: size is 139561704l
2013-05-11T11:51:16.478+02:00 trinity kernel: here: size is 4l
2013-05-11T11:51:16.478+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-11T11:51:16.478+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-11T11:51:16.478+02:00 trinity kernel: CPU: 0 PID: 880 Comm: trinity-child0 Not tainted 3.9.0-12555-g2dbd3ca-dirty #1
2013-05-11T11:51:16.478+02:00 trinity kernel: 40217da8 40217dd4 0807bfca 083d3e1c 083d85d3 00000178 080e11f3 080e11f3 
2013-05-11T11:51:16.478+02:00 trinity kernel: fffffff2 000000d0 00000004 40217de4 0807c093 00000009 00000000 40217df8 
2013-05-11T11:51:16.478+02:00 trinity kernel: 080e11f3 083d85d3 00000178 00000000 40217e1c 080fabfb fffffff2 000000d0 40217d7c:  [<08060cff>] show_stack+0xcf/0x100
2013-05-11T11:51:16.478+02:00 trinity kernel: 40217da0:  [<0835d5ca>] dump_stack+0x26/0x28
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217db0:  [<0807bfca>] warn_slowpath_common+0x5a/0x80
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217dd8:  [<0807c093>] warn_slowpath_null+0x23/0x30
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217de8:  [<080e11f3>] kmalloc_slab+0x33/0x80
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217dfc:  [<080fabfb>] __kmalloc_track_caller+0x1b/0x110
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217e20:  [<080de1a6>] memdup_user+0x26/0x70
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217e3c:  [<080de3ae>] strndup_user+0x3e/0x60
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217e58:  [<0811dcd0>] copy_mount_string+0x40/0x60
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217e70:  [<0811e6f0>] SyS_mount+0x30/0xf0
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217eac:  [<08062ac2>] handle_syscall+0x82/0xb0
2013-05-11T11:51:16.484+02:00 trinity kernel: 40217ef4:  [<0807519d>] userspace+0x46d/0x590
2013-05-11T11:51:16.488+02:00 trinity kernel: 40217fec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-11T11:51:16.488+02:00 trinity kernel: 40217ffc:  [<00000000>] 0x0
2013-05-11T11:51:16.488+02:00 trinity kernel: 
2013-05-11T11:51:16.488+02:00 trinity kernel: ---[ end trace 2972c179d5e65541 ]---
2013-05-11T11:51:16.488+02:00 trinity kernel: here: size is 4l
2013-05-11T11:51:16.488+02:00 trinity kernel: here: size is 135041024l
2013-05-11T11:51:16.488+02:00 trinity kernel: here: size is 1l
2013-05-11T11:51:16.488+02:00 trinity kernel: here: size is 135065600l
2013-05-11T11:51:16.488+02:00 trinity kernel: here: size is 139398224l
2013-05-11T11:51:16.526+02:00 trinity kernel: here: size is 135053312l
Signature · 14 lines
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
#6 lore raw

fs/namespace.c int copy_mount_string(const void __user *data, char **where) · line 2239

Quoted 11 lines

With this change:

fs/namespace.c +1 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
 
+       printk(" here: size is %ul\n", (unsigned long)data);

Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.

Quoted 4 lines
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134565664l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134565632l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134564296l
2013-05-11T11:51:00.551+02:00 trinity kernel: here: size is 134564312l
Signature · 1 line
  Sergei

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#7 lore raw
Quoted 10 lines · Sergei Trofimovich
Quoted 10 lines

With this change:

fs/namespace.c +0 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
Quoted 3 lines

fs/namespace.c int copy_mount_string(const void __user *data, char **where) · line 2239

Quoted 1 line
fs/namespace.c +1 -0
+       printk(" here: size is %ul\n", (unsigned long)data);

Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.

Erm, data is a character array...

--
Thanks,
//richard

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#8 lore raw
Quoted 11 lines · On Sat, 11 May 2013 13:29:23 +0200 richard -rw- weinberger…
Quoted 10 lines · Sergei Trofimovich
Quoted 10 lines

With this change:

fs/namespace.c +0 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
Quoted 5 lines
Quoted 3 lines

fs/namespace.c int copy_mount_string(const void __user *data, char **where) · line 2239

Quoted 1 line
fs/namespace.c +1 -0
+       printk(" here: size is %ul\n", (unsigned long)data);

Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.

Erm, data is a character array...

Gah, sorry!

Toralf, it's better to use strnlen_user for it:

fs/namespace.c +4 -0
@@ -2230,12 +2230,16 @@ int copy_mount_options(const void __user * data, unsigned long *where)
 int copy_mount_string(const void __user *data, char **where)
 {
        char *tmp;
+       long data_len;
 
        if (!data) {
                *where = NULL;
                return 0;
        }
 
+       data_len = strnlen_user (data, (long)(~0ul >> 1) /* LONG_MAX */);
+       printk("%s: __user * data size is %lu\n", __func__, data_len);
+
        tmp = strndup_user(data, PAGE_SIZE);
        if (IS_ERR(tmp))
                return PTR_ERR(tmp);
Signature · 1 line
  Sergei

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#9 lore raw
In reply to Sergei Trofimovich
Quoted 10 lines · Sergei Trofimovich
Quoted 10 lines

With this change:

fs/namespace.c +0 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
Quoted 3 lines

fs/namespace.c int copy_mount_string(const void __user *data, char **where) · line 2239

Quoted 1 line
fs/namespace.c +1 -0
+       printk(" here: size is %ul\n", (unsigned long)data);

Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.

Toralf, please use the attached patch.
Maybe it helps us.
In theory we call kmalloc() with at most PAGE_SIZE, which is okay.

--
Thanks,
//richard

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#10 lore raw
Quoted 11 lines · richard -rw- weinberger
Quoted 10 lines · Sergei Trofimovich
Quoted 10 lines

With this change:

fs/namespace.c +0 -0
index 7b1ca9b..289211d 100644
@@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
                return 0;
        }
Quoted 7 lines
Quoted 3 lines

fs/namespace.c int copy_mount_string(const void __user *data, char **where) · line 2239

Quoted 1 line
fs/namespace.c +1 -0
+       printk(" here: size is %ul\n", (unsigned long)data);

Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.

Toralf, please use the attached patch.
Maybe it helps us.
In theory we call kmalloc() with at most PAGE_SIZE, which is okay.

fixing -ENOATTACHMENT...

--
Thanks,
//richard

fs/namespace.c +1 -1
index 7b1ca9b..7f9bf58a 100644
@@ -2236,7 +2236,7 @@ int copy_mount_string(const void __user *data, char **where)
 		return 0;
 	}
 
-	tmp = strndup_user(data, PAGE_SIZE);
+	tmp = strndup_user_debug(data, PAGE_SIZE, true);
 	if (IS_ERR(tmp))
 		return PTR_ERR(tmp);
include/linux/string.h +1 -0
index ac889c5..3b962b8 100644
@@ -9,6 +9,7 @@
 #include <uapi/linux/string.h>
 
 extern char *strndup_user(const char __user *, long);
+extern char *strndup_user_debug(const char __user *, long, bool);
 extern void *memdup_user(const void __user *, size_t);
 
 /*
mm/util.c +13 -1
index ab1424d..c95b08c 100644
@@ -203,13 +203,16 @@ EXPORT_SYMBOL(kzfree);
  * @s: The string to duplicate
  * @n: Maximum number of bytes to copy, including the trailing NUL.
  */
-char *strndup_user(const char __user *s, long n)
+char *strndup_user_debug(const char __user *s, long n, bool debug)
 {
 	char *p;
 	long length;
 
 	length = strnlen_user(s, n);
 
+	if (debug)
+		printk(KERN_ERR "%s: strnlen_user() returned: %li\n", __func__, length);
+
 	if (!length)
 		return ERR_PTR(-EFAULT);
 

@@ -218,6 +221,9 @@ char *strndup_user(const char __user *s, long n)
 
 	p = memdup_user(s, length);
 
+	if (debug)
+		printk(KERN_ERR "%s: calling memdup_user() with length: %li\n", __func__, length);
+
 	if (IS_ERR(p))
 		return p;
 

@@ -225,6 +231,12 @@ char *strndup_user(const char __user *s, long n)
 
 	return p;
 }
+EXPORT_SYMBOL(strndup_user_debug);
+
+char *strndup_user(const char __user *s, long n)
+{
+	return strndup_user_debug(s, n, false);
+}
 EXPORT_SYMBOL(strndup_user);
 
 void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

author
#11 lore raw
Quoted 7 lines · richard -rw- weinberger
Quoted 3 lines · richard -rw- weinberger

On Sat, May 11, 2013 at 1:01 PM, Sergei Trofimovic>> Toralf, please use the attached patch. Maybe it helps us.
In theory we call kmalloc() with at most PAGE_SIZE, which is okay.

fixing -ENOATTACHMENT...

applying that patch on top of Linus' tree (v3.9-12555-g2dbd3ca) gives :

2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged starting up
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged: Completed tot procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: version 5.6.4 starting
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: ipv6_open: Address family not supported by protocol
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed tot procedure A after 1035716 bytes
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: version: 1.5; arch: x86; vendor: GenuineIntel; cores: 1/1, buffer: 128
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: d_cache: 32K (000020), i_cache: 32K (000020), i_index: 19/40, i_size: 32653/60731
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: tot tests: BA8, continuous tests: B
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed continuous procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: rebinding lease of 192.168.1.63
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: acknowledged 192.168.1.63 from 192.168.0.254
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: checking for 192.168.1.63
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: eth0: leased 192.168.1.63 for infinity
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: forked to background, child pid 811
2013-05-11T15:15:44.000+02:00 trinity cron[855]: (CRON) STARTUP (V5.0)
2013-05-11T15:15:44.944+02:00 trinity kernel: Virtual console 1 assigned device '/dev/pts/6'
2013-05-11T15:16:01.000+02:00 trinity sshd[874]: pam_unix(sshd:session): session opened for user tfoerste by (uid=0)
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.827+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-11T15:16:02.827+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-11T15:16:02.827+02:00 trinity kernel: CPU: 0 PID: 880 Comm: trinity-child0 Not tainted 3.9.0-12555-g2dbd3ca-dirty #1
2013-05-11T15:16:02.827+02:00 trinity kernel: 40db7da0 40db7dcc 0807bfca 083d3e6c 083d8623 00000178 080e1273 080e1273 
2013-05-11T15:16:02.827+02:00 trinity kernel: ffffffea 000000d0 00001000 40db7ddc 0807c093 00000009 00000000 40db7df0 
2013-05-11T15:16:02.835+02:00 trinity kernel: 080e1273 083d8623 00000178 00000000 40db7e14 080fac7b fffffff2 000000d0 40db7d74:  [<08060cff>] show_stack+0xcf/0x100
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7d98:  [<0835d63a>] dump_stack+0x26/0x28
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7da8:  [<0807bfca>] warn_slowpath_common+0x5a/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7dd0:  [<0807c093>] warn_slowpath_null+0x23/0x30
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7de0:  [<080e1273>] kmalloc_slab+0x33/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7df4:  [<080fac7b>] __kmalloc_track_caller+0x1b/0x110
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e18:  [<080de1a6>] memdup_user+0x26/0x70
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e34:  [<080de3de>] strndup_user_debug+0x6e/0xb0
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e58:  [<0811dd48>] copy_mount_string+0x38/0x50
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e70:  [<0811e760>] SyS_mount+0x30/0xf0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7eac:  [<08062ac2>] handle_syscall+0x82/0xb0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ef4:  [<0807519d>] userspace+0x46d/0x590
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7fec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ffc:  [<00000000>] 0x0
2013-05-11T15:16:02.842+02:00 trinity kernel: 
2013-05-11T15:16:02.842+02:00 trinity kernel: ---[ end trace 06fc96a70dca162e ]---
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
Signature · 14 lines
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
#12 lore raw
Quoted 73 lines · Toralf Förster
Quoted 7 lines · richard -rw- weinberger
Quoted 3 lines · richard -rw- weinberger

On Sat, May 11, 2013 at 1:01 PM, Sergei Trofimovic>> Toralf, please use the attached patch. Maybe it helps us.
In theory we call kmalloc() with at most PAGE_SIZE, which is okay.

fixing -ENOATTACHMENT...

applying that patch on top of Linus' tree (v3.9-12555-g2dbd3ca) gives :

2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged starting up
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged: Completed tot procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: version 5.6.4 starting
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: ipv6_open: Address family not supported by protocol
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed tot procedure A after 1035716 bytes
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: version: 1.5; arch: x86; vendor: GenuineIntel; cores: 1/1, buffer: 128
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: d_cache: 32K (000020), i_cache: 32K (000020), i_index: 19/40, i_size: 32653/60731
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: tot tests: BA8, continuous tests: B
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed continuous procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: rebinding lease of 192.168.1.63
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: acknowledged 192.168.1.63 from 192.168.0.254
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: checking for 192.168.1.63
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: eth0: leased 192.168.1.63 for infinity
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: forked to background, child pid 811
2013-05-11T15:15:44.000+02:00 trinity cron[855]: (CRON) STARTUP (V5.0)
2013-05-11T15:15:44.944+02:00 trinity kernel: Virtual console 1 assigned device '/dev/pts/6'
2013-05-11T15:16:01.000+02:00 trinity sshd[874]: pam_unix(sshd:session): session opened for user tfoerste by (uid=0)
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.827+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-11T15:16:02.827+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-11T15:16:02.827+02:00 trinity kernel: CPU: 0 PID: 880 Comm: trinity-child0 Not tainted 3.9.0-12555-g2dbd3ca-dirty #1
2013-05-11T15:16:02.827+02:00 trinity kernel: 40db7da0 40db7dcc 0807bfca 083d3e6c 083d8623 00000178 080e1273 080e1273
2013-05-11T15:16:02.827+02:00 trinity kernel: ffffffea 000000d0 00001000 40db7ddc 0807c093 00000009 00000000 40db7df0
2013-05-11T15:16:02.835+02:00 trinity kernel: 080e1273 083d8623 00000178 00000000 40db7e14 080fac7b fffffff2 000000d0 40db7d74:  [<08060cff>] show_stack+0xcf/0x100
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7d98:  [<0835d63a>] dump_stack+0x26/0x28
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7da8:  [<0807bfca>] warn_slowpath_common+0x5a/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7dd0:  [<0807c093>] warn_slowpath_null+0x23/0x30
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7de0:  [<080e1273>] kmalloc_slab+0x33/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7df4:  [<080fac7b>] __kmalloc_track_caller+0x1b/0x110
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e18:  [<080de1a6>] memdup_user+0x26/0x70
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e34:  [<080de3de>] strndup_user_debug+0x6e/0xb0
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e58:  [<0811dd48>] copy_mount_string+0x38/0x50
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e70:  [<0811e760>] SyS_mount+0x30/0xf0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7eac:  [<08062ac2>] handle_syscall+0x82/0xb0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ef4:  [<0807519d>] userspace+0x46d/0x590
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7fec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ffc:  [<00000000>] 0x0
2013-05-11T15:16:02.842+02:00 trinity kernel:
2013-05-11T15:16:02.842+02:00 trinity kernel: ---[ end trace 06fc96a70dca162e ]---
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
Quoted 4 lines

--
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

Does the attached patch fix the problem?

--
Thanks,
//richard

mm/util.c +1 -1
index ab1424d..c4eb439 100644
@@ -210,7 +210,7 @@ char *strndup_user(const char __user *s, long n)
 
 	length = strnlen_user(s, n);
 
-	if (!length)
+	if (length < 1)
 		return ERR_PTR(-EFAULT);
 
 	if (length > n)

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

#13 lore raw
Quoted 74 lines · richard -rw- weinberger
Quoted 73 lines · Toralf Förster
Quoted 7 lines · richard -rw- weinberger
Quoted 3 lines · richard -rw- weinberger

On Sat, May 11, 2013 at 1:01 PM, Sergei Trofimovic>> Toralf, please use the attached patch. Maybe it helps us.
In theory we call kmalloc() with at most PAGE_SIZE, which is okay.

fixing -ENOATTACHMENT...

applying that patch on top of Linus' tree (v3.9-12555-g2dbd3ca) gives :

2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 5
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 12
2013-05-11T15:15:37.166+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 12
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged starting up
2013-05-11T15:15:37.000+02:00 trinity haveged: haveged: Completed tot procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: version 5.6.4 starting
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: ipv6_open: Address family not supported by protocol
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed tot procedure A after 1035716 bytes
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: version: 1.5; arch: x86; vendor: GenuineIntel; cores: 1/1, buffer: 128
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: d_cache: 32K (000020), i_cache: 32K (000020), i_index: 19/40, i_size: 32653/60731
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: tot tests: BA8, continuous tests: B
2013-05-11T15:15:38.000+02:00 trinity haveged: haveged: Completed continuous procedure B after 1171643 bytes
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: rebinding lease of 192.168.1.63
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: acknowledged 192.168.1.63 from 192.168.0.254
2013-05-11T15:15:38.000+02:00 trinity dhcpcd[777]: eth0: checking for 192.168.1.63
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: eth0: leased 192.168.1.63 for infinity
2013-05-11T15:15:43.000+02:00 trinity dhcpcd[777]: forked to background, child pid 811
2013-05-11T15:15:44.000+02:00 trinity cron[855]: (CRON) STARTUP (V5.0)
2013-05-11T15:15:44.944+02:00 trinity kernel: Virtual console 1 assigned device '/dev/pts/6'
2013-05-11T15:16:01.000+02:00 trinity sshd[874]: pam_unix(sshd:session): session opened for user tfoerste by (uid=0)
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 25
2013-05-11T15:16:02.827+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.827+02:00 trinity kernel: ------------[ cut here ]------------
2013-05-11T15:16:02.827+02:00 trinity kernel: WARNING: at mm/slab_common.c:376 kmalloc_slab+0x33/0x80()
2013-05-11T15:16:02.827+02:00 trinity kernel: CPU: 0 PID: 880 Comm: trinity-child0 Not tainted 3.9.0-12555-g2dbd3ca-dirty #1
2013-05-11T15:16:02.827+02:00 trinity kernel: 40db7da0 40db7dcc 0807bfca 083d3e6c 083d8623 00000178 080e1273 080e1273
2013-05-11T15:16:02.827+02:00 trinity kernel: ffffffea 000000d0 00001000 40db7ddc 0807c093 00000009 00000000 40db7df0
2013-05-11T15:16:02.835+02:00 trinity kernel: 080e1273 083d8623 00000178 00000000 40db7e14 080fac7b fffffff2 000000d0 40db7d74:  [<08060cff>] show_stack+0xcf/0x100
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7d98:  [<0835d63a>] dump_stack+0x26/0x28
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7da8:  [<0807bfca>] warn_slowpath_common+0x5a/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7dd0:  [<0807c093>] warn_slowpath_null+0x23/0x30
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7de0:  [<080e1273>] kmalloc_slab+0x33/0x80
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7df4:  [<080fac7b>] __kmalloc_track_caller+0x1b/0x110
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e18:  [<080de1a6>] memdup_user+0x26/0x70
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e34:  [<080de3de>] strndup_user_debug+0x6e/0xb0
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e58:  [<0811dd48>] copy_mount_string+0x38/0x50
2013-05-11T15:16:02.835+02:00 trinity kernel: 40db7e70:  [<0811e760>] SyS_mount+0x30/0xf0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7eac:  [<08062ac2>] handle_syscall+0x82/0xb0
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ef4:  [<0807519d>] userspace+0x46d/0x590
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7fec:  [<0805f7fc>] fork_handler+0x6c/0x70
2013-05-11T15:16:02.842+02:00 trinity kernel: 40db7ffc:  [<00000000>] 0x0
2013-05-11T15:16:02.842+02:00 trinity kernel:
2013-05-11T15:16:02.842+02:00 trinity kernel: ---[ end trace 06fc96a70dca162e ]---
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
2013-05-11T15:16:02.842+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 16
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 1
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: 70
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: strnlen_user() returned: -14
2013-05-11T15:16:02.850+02:00 trinity kernel: strndup_user_debug: calling memdup_user() with length: -14
Quoted 6 lines
Quoted 4 lines

--
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

Does the attached patch fix the problem?

Found the real problem, UML's strnlen_user() is broken. Please test the attached patch.

--
Thanks,
//richard

arch/um/kernel/skas/uaccess.c +1 -1
index 1d3e0c1..4ffb644 100644
@@ -254,6 +254,6 @@ int strnlen_user(const void __user *str, int len)
 	n = buffer_op((unsigned long) str, len, 0, strnlen_chunk, &count);
 	if (n == 0)
 		return count + 1;
-	return -EFAULT;
+	return 0;
 }
 EXPORT_SYMBOL(strnlen_user);

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

author
#14 lore raw
Quoted 2 lines · richard -rw- weinberger

Found the real problem, UML's strnlen_user() is broken. Please test the attached patch.

yeah, that works now :-)

Signature · 14 lines
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
author
#15 lore raw
In reply to richard -rw- weinberger
Quoted 1 line · richard -rw- weinberger

Does the attached patch fix the problem?

yes,

but this occurred (probably completely unrelated :)

2013-05-11T15:42:32.829+02:00 trinity kernel: Adding 262140k swap on /dev/mapper/crypt-swap.  Priority:-1 extents:1 across:262140k FS
2013-05-11T15:42:33.000+02:00 trinity haveged: haveged starting up
2013-05-11T15:42:33.000+02:00 trinity haveged: haveged: Completed tot procedure B after 1171996 bytes
2013-05-11T15:42:35.701+02:00 trinity kernel: BUG: spinlock cpu recursion on CPU#0, kworker/0:2/346
2013-05-11T15:42:35.701+02:00 trinity kernel: lock: 0x40c4a6c0, .magic: dead4ead, .owner: <none>/-1, .owner_cpu: 0
2013-05-11T15:42:35.701+02:00 trinity kernel: CPU: 0 PID: 346 Comm: kworker/0:2 Not tainted 3.9.0-12555-g2dbd3ca-dirty #1
2013-05-11T15:42:35.701+02:00 trinity kernel: Workqueue: events cache_reap
2013-05-11T15:42:35.701+02:00 trinity kernel: 40fa7e50 40fa7e80 0835d6cb 083f28e0 40c4a6c0 dead4ead 083f27a9 ffffffff 
2013-05-11T15:42:35.701+02:00 trinity kernel: 00000000 40fa0000 40c4a6c0 083f27ba 40fa7e90 0835d6ed 40c4a6c0 00000000 
2013-05-11T15:42:35.701+02:00 trinity kernel: 40fa7eb0 08281513 00000000 00000003 40fa0000 40c4a6c0 00000000 40c488c0 40fa7e24:  [<08060cff>] show_stack+0xcf/0x100
2013-05-11T15:42:35.701+02:00 trinity kernel: 40fa7e48:  [<0835d5ba>] dump_stack+0x26/0x28
2013-05-11T15:42:35.701+02:00 trinity kernel: 40fa7e58:  [<0835d6cb>] spin_dump+0xa5/0xac
2013-05-11T15:42:35.701+02:00 trinity kernel: 40fa7e84:  [<0835d6ed>] spin_bug+0x1b/0x1f
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7e94:  [<08281513>] do_raw_spin_lock+0x63/0x100
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7eb4:  [<0835fc96>] _raw_spin_lock_irq+0x16/0x20
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7ec0:  [<080fb1e8>] drain_freelist+0x38/0xf0
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7ef0:  [<080fb35c>] cache_reap+0xbc/0x120
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7f14:  [<08093e20>] process_one_work+0x1c0/0x310
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7f58:  [<0809441a>] worker_thread+0x1fa/0x300
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7f84:  [<08099c82>] kthread+0xc2/0xd0
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7fec:  [<0805f87a>] new_thread_handler+0x7a/0xa0
2013-05-11T15:42:35.702+02:00 trinity kernel: 40fa7ffc:  [<00000000>] 0x0
2013-05-11T15:42:35.702+02:00 trinity kernel: 
2013-05-11T15:42:35.000+02:00 trinity haveged: haveged: Completed tot procedure A after 1035716 bytes
2013-05-11T15:42:35.000+02:00 trinity haveged: haveged: version: 1.5; arch: x86; vendor: GenuineIntel; cores: 1/1, buffer: 128
2013-05-11T15:42:35.000+02:00 trinity haveged: haveged: d_cache: 32K (000020), i_cache: 32K (000020), i_index: 19/40, i_size: 32653/60731
2013-05-11T15:42:35.000+02:00 trinity haveged: haveged: tot tests: BA8, continuous tests: B
2013-05-11T15:42:35.000+02:00 trinity haveged: haveged: Completed continuous procedure B after 1171996 bytes
2013-05-11T15:42:35.000+02:00 trinity dhcpcd[770]: version 5.6.4 starting
Signature · 14 lines
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel