From: =?UTF-8?B?VG9yYWxmIEbDtnJzdGVy?= Subject: Re: [uml-devel] fuzz tested 32 bit user mode linux image hangs in radix_tree_next_chunk() Date: Sun, 10 Nov 2013 16:14:06 +0100 Message-ID: <527FA2BE.6090307@gmx.de> References: <526696BF.6050909@gmx.de> <5266A698.10400@gmx.de> <5266B60A.1000005@nod.at> <52715AD1.7000703@gmx.de> <527AB23D.2060305@gmx.de> <527AB51B.1020005@nod.at> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: Konstantin Khlebnikov , Linux Kernel , linux-fsdevel , "linux-mm@kvack.org" , UML devel To: Richard Weinberger Return-path: In-Reply-To: <527AB51B.1020005@nod.at> Sender: owner-linux-mm@kvack.org List-Id: linux-fsdevel.vger.kernel.org On 11/06/2013 10:31 PM, Richard Weinberger wrote: > Am 06.11.2013 22:18, schrieb Toralf F=C3=B6rster: >> On 11/06/2013 05:06 PM, Konstantin Khlebnikov wrote: >>> In this case it must stop after scanning whole tree in line: >>> /* Overflow after ~0UL */ >>> if (!index) >>> return NULL; >>> >> >> A fresh current example with latest git tree shows that lines 769 and = 770 do alternate : >=20 > Can you please ask gdb for the value of offset? >=20 > Thanks, > //richard >=20 With this change=20 diff --git a/lib/radix-tree.c b/lib/radix-tree.c index 7811ed3..b2e9db5 100644 --- a/lib/radix-tree.c +++ b/lib/radix-tree.c @@ -767,6 +767,7 @@ restart: offset + 1); else while (++offset < RADIX_TREE_MAP_SIZE) { + printk ("node->slots[offset] %p o= ffeset %lu\n", node->slots[offset], offset); if (node->slots[offset]) break; } against v3.12-48-gbe408cd these are the last lines in the syslog of the U= ML (command: ssh root@trinity "tail -f /var/log/messages") ... Nov 10 13:26:32 trinity kernel: node->slots[offset] (null) offeset 23 Nov 10 13:26:32 trinity kernel: node->slots[offset] (null) offeset 24 Nov 10 13:26:32 trinity kernel: node->slots[offset] (null) offeset 25 Nov 10 13:26:32 trinity kernel: node->slots[offset] (null) offeset 26 Nov 10 13:26:32 trinity kernel: node->slots[offset] (null) offeset 27 ... Nov 10 13:49:11 trinity sshd[3628]: pam_unix(sshd:session): session close= d for user tfoerste Nov 10 13:49:15 trinity sshd[3858]: pam_unix(sshd:session): session opene= d for user tfoerste by (uid=3D0) Nov 10 13:49:15 trinity su[3862]: Successful su for root by root Nov 10 13:49:15 trinity su[3862]: + ??? root:root Nov 10 13:49:15 trinity su[3862]: pam_unix(su:session): session opened fo= r user root by (uid=3D0) Nov 10 13:49:15 trinity su[3862]: pam_unix(su:session): session closed fo= r user root Nov 10 13:49:15 trinity tfoerste: M=3D/mnt/hostfs It is now at (I left the computer for a while) and I gdo et this output o= f 3 subsequent calls of the gdb back trace at the host system : tfoerste@n22 ~/devel/linux $ sudo gdb /home/tfoerste/devel/linux/linux 89= 46 -n -batch -ex bt string (buf=3D0x8609ef9 "ll) offeset 4\n", end=3D0x860= a2c0 "4721fffc: [<00000000>] 0x0k_handler+0x60/0x700360d/0x4e00ff= ff 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/0xf0", s=3D0x84c0980= "ll)", spec=3D...) at lib/vsprintf.c:524 524 *buf =3D *s; #0 string (buf=3D0x8609ef9 "ll) offeset 4\n", end=3D0= x860a2c0 "4721fffc: [<00000000>] 0x0k_handler+0x60/0x700360d/0x4e= 00ffff 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/0xf0", s=3D0x84c= 0980 "ll)", spec=3D...) at lib/vsprintf.c:524 #1 0x0829ac42 in pointer (fmt=3D0x75
, buf=3D= 0x8609ef4 " (null) offeset 4\n", end=3D0x5
, ptr=3D0x0, spec=3D...) at lib/vsprintf.c:1239 #2 0x0829a9dd in vsnprintf (buf=3D0x8609ee0 "node->slots= [offset] (null) offeset 4\n", size=3D992, fmt=3D0x8609efc " offeset 4\n", args=3D0x4370fc10 "") at lib/vsprintf.c:1667 #3 0x0829b0f7 in vscnprintf (buf=3D0x75
, si= ze=3D992, fmt=3D0x75
, args=3D0x75
) at lib/vsprintf.c:1776 #4 0x080a6968 in vprintk_emit (facility=3D0, level=3D-1, dict=3D0x0, dic= tlen=3D0, fmt=3D0x75
, args=3D0x75
) at kernel/printk/printk.c:1548 #5 0x08419b05 in printk (fmt=3D0x75
) at ker= nel/printk/printk.c:1690 #6 0x08296a8d in radix_tree_next_chunk (root=3D0x75, iter=3D0x4370fc54, = flags=3D0) at lib/radix-tree.c:770 #7 0x080cc1fe in find_get_pages (mapping=3D0x44bb707c, start=3D0, nr_pag= es=3D14, pages=3D0x5) at mm/filemap.c:844 #8 0x080d5d6a in pagevec_lookup (pvec=3D0x4370fcb8, mapping=3D0x75, star= t=3D117, nr_pages=3D117) at mm/swap.c:914 #9 0x080d615a in truncate_inode_pages_range (mapping=3D0x44bb707c, lstar= t=3D32809, lend=3D-1) at mm/truncate.c:241 #10 0x080d64ff in truncate_inode_pages (mapping=3D0x75, lstart=3D21474836= 597) at mm/truncate.c:358 #11 0x080d6a0d in truncate_pagecache (inode=3D0x75, newsize=3D32809) at m= m/truncate.c:597 #12 0x081d9118 in nfs_vmtruncate (offset=3D, inode=3D) at fs/nfs/inode.c:554 #13 nfs_setattr_update_inode (inode=3D0x44bb6fc4, attr=3D0x8029) at fs/nf= s/inode.c:585 #14 0x081e73ba in nfs_proc_setattr (dentry=3D0x75, fattr=3D0x0, sattr=3D0= x4370fe1c) at fs/nfs/proc.c:142 #15 0x081da99c in nfs_setattr (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) at= fs/nfs/inode.c:523 #16 0x0811c256 in notify_change (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) = at fs/attr.c:248 #17 0x081011bb in do_truncate (dentry=3D0x47fb5b00, length=3D502511206441= , time_attrs=3D5, filp=3D0x8609efc ) at fs/open.c:60 #18 0x081013f2 in do_sys_ftruncate (fd=3D117, length=3D32809, small=3D1) = at fs/open.c:190 #19 0x081016da in SYSC_ftruncate (length=3D, fd=3D) at fs/open.c:200 #20 SyS_ftruncate (fd=3D129, length=3D32809) at fs/open.c:198 #21 0x08062974 in handle_syscall (r=3D0x473c9fd4) at arch/um/kernel/skas/= syscall.c:35 #22 0x08074fa5 in handle_trap (local_using_sysemu=3D, regs= =3D, pid=3D) at arch/um/os-Linux/skas/proce= ss.c:198 #23 userspace (regs=3D0x473c9fd4) at arch/um/os-Linux/skas/process.c:431 #24 0x0805f740 in fork_handler () at arch/um/kernel/process.c:160 #25 0x00000000 in ?? () tfoerste@n22 ~/devel/linux $ sudo gdb /home/tfoerste/devel/linux/linux 89= 46 -n -batch -ex bt 0x082995e7 in string (buf=3D0x8609ef8 "ull) offeset 57= \n", end=3D0x860a2c0 "4721fffc: [<00000000>] 0x0k_handler+0x60/0x= 700360d/0x4e00ffff 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/0xf0= ", s=3D0x84c097f "ull)", spec=3D...) at lib/vsprintf.c:524 524 *buf =3D *s; #0 0x082995e7 in string (buf=3D0x8609ef8 "ull) offese= t 57\n", end=3D0x860a2c0 "4721fffc: [<00000000>] 0x0k_handler+0x6= 0/0x700360d/0x4e00ffff 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/= 0xf0", s=3D0x84c097f "ull)", spec=3D...) at lib/vsprintf.c:524 #1 0x0829ac42 in pointer (fmt=3D0x75
, buf=3D= 0x8609ef4 " (null) offeset 57\n", end=3D0x5
, ptr=3D0x0, spec=3D...) at lib/vsprintf.c:1239 #2 0x0829a9dd in vsnprintf (buf=3D0x8609ee0 "node->slots= [offset] (null) offeset 57\n", size=3D992, fmt=3D0x8609efc " offeset 57\n", args=3D0x4370fc10 "") at lib/vsprintf.c:1667 #3 0x0829b0f7 in vscnprintf (buf=3D0x75
, si= ze=3D992, fmt=3D0x75
, args=3D0x75
) at lib/vsprintf.c:1776 #4 0x080a6968 in vprintk_emit (facility=3D0, level=3D-1, dict=3D0x0, dic= tlen=3D0, fmt=3D0x75
, args=3D0x75
) at kernel/printk/printk.c:1548 #5 0x08419b05 in printk (fmt=3D0x75
) at ker= nel/printk/printk.c:1690 #6 0x08296a8d in radix_tree_next_chunk (root=3D0x75, iter=3D0x4370fc54, = flags=3D0) at lib/radix-tree.c:770 #7 0x080cc1fe in find_get_pages (mapping=3D0x44bb707c, start=3D0, nr_pag= es=3D14, pages=3D0x5) at mm/filemap.c:844 #8 0x080d5d6a in pagevec_lookup (pvec=3D0x4370fcb8, mapping=3D0x75, star= t=3D117, nr_pages=3D117) at mm/swap.c:914 #9 0x080d615a in truncate_inode_pages_range (mapping=3D0x44bb707c, lstar= t=3D32809, lend=3D-1) at mm/truncate.c:241 #10 0x080d64ff in truncate_inode_pages (mapping=3D0x75, lstart=3D21474836= 597) at mm/truncate.c:358 #11 0x080d6a0d in truncate_pagecache (inode=3D0x75, newsize=3D32809) at m= m/truncate.c:597 #12 0x081d9118 in nfs_vmtruncate (offset=3D, inode=3D) at fs/nfs/inode.c:554 #13 nfs_setattr_update_inode (inode=3D0x44bb6fc4, attr=3D0x8029) at fs/nf= s/inode.c:585 #14 0x081e73ba in nfs_proc_setattr (dentry=3D0x75, fattr=3D0x0, sattr=3D0= x4370fe1c) at fs/nfs/proc.c:142 #15 0x081da99c in nfs_setattr (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) at= fs/nfs/inode.c:523 #16 0x0811c256 in notify_change (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) = at fs/attr.c:248 #17 0x081011bb in do_truncate (dentry=3D0x47fb5b00, length=3D502511206441= , time_attrs=3D5, filp=3D0x8609efc ) at fs/open.c:60 #18 0x081013f2 in do_sys_ftruncate (fd=3D117, length=3D32809, small=3D1) = at fs/open.c:190 #19 0x081016da in SYSC_ftruncate (length=3D, fd=3D) at fs/open.c:200 #20 SyS_ftruncate (fd=3D129, length=3D32809) at fs/open.c:198 #21 0x08062974 in handle_syscall (r=3D0x473c9fd4) at arch/um/kernel/skas/= syscall.c:35 #22 0x08074fa5 in handle_trap (local_using_sysemu=3D, regs= =3D, pid=3D) at arch/um/os-Linux/skas/proce= ss.c:198 #23 userspace (regs=3D0x473c9fd4) at arch/um/os-Linux/skas/process.c:431 #24 0x0805f740 in fork_handler () at arch/um/kernel/process.c:160 #25 0x00000000 in ?? () tfoerste@n22 ~/devel/linux $ sudo gdb /home/tfoerste/devel/linux/linux 89= 46 -n -batch -ex bt string (buf=3D0x8609efb ") offeset 20\n", end=3D0x860a= 2c0 "4721fffc: [<00000000>] 0x0k_handler+0x60/0x700360d/0x4e00fff= f 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/0xf0", s=3D0x84c0982 = ")", spec=3D...) at lib/vsprintf.c:524 524 *buf =3D *s; #0 string (buf=3D0x8609efb ") offeset 20\n", end=3D0x= 860a2c0 "4721fffc: [<00000000>] 0x0k_handler+0x60/0x700360d/0x4e0= 0ffff 00000000 4721fc0c: [<0805f8cc>] __switch_to+0x5c/0xf0", s=3D0x84c0= 982 ")", spec=3D...) at lib/vsprintf.c:524 #1 0x0829ac42 in pointer (fmt=3D0x6c
, buf=3D= 0x8609ef4 " (null) offeset 20\n", end=3D0x5
, ptr=3D0x0, spec=3D...) at lib/vsprintf.c:1239 #2 0x0829a9dd in vsnprintf (buf=3D0x8609ee0 "node->slots= [offset] (null) offeset 20\n", size=3D992, fmt=3D0x8609efc " offeset 20\n", args=3D0x4370fc10 "") at lib/vsprintf.c:1667 #3 0x0829b0f7 in vscnprintf (buf=3D0x6c
, si= ze=3D992, fmt=3D0x6c
, args=3D0x6c
) at lib/vsprintf.c:1776 #4 0x080a6968 in vprintk_emit (facility=3D0, level=3D-1, dict=3D0x0, dic= tlen=3D0, fmt=3D0x6c
, args=3D0x6c
) at kernel/printk/printk.c:1548 #5 0x08419b05 in printk (fmt=3D0x6c
) at ker= nel/printk/printk.c:1690 #6 0x08296a8d in radix_tree_next_chunk (root=3D0x6c, iter=3D0x4370fc54, = flags=3D0) at lib/radix-tree.c:770 #7 0x080cc1fe in find_get_pages (mapping=3D0x44bb707c, start=3D0, nr_pag= es=3D14, pages=3D0x5) at mm/filemap.c:844 #8 0x080d5d6a in pagevec_lookup (pvec=3D0x4370fcb8, mapping=3D0x6c, star= t=3D108, nr_pages=3D108) at mm/swap.c:914 #9 0x080d615a in truncate_inode_pages_range (mapping=3D0x44bb707c, lstar= t=3D32809, lend=3D-1) at mm/truncate.c:241 #10 0x080d64ff in truncate_inode_pages (mapping=3D0x6c, lstart=3D21474836= 588) at mm/truncate.c:358 #11 0x080d6a0d in truncate_pagecache (inode=3D0x6c, newsize=3D32809) at m= m/truncate.c:597 #12 0x081d9118 in nfs_vmtruncate (offset=3D, inode=3D) at fs/nfs/inode.c:554 #13 nfs_setattr_update_inode (inode=3D0x44bb6fc4, attr=3D0x8029) at fs/nf= s/inode.c:585 #14 0x081e73ba in nfs_proc_setattr (dentry=3D0x6c, fattr=3D0x0, sattr=3D0= x4370fe1c) at fs/nfs/proc.c:142 #15 0x081da99c in nfs_setattr (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) at= fs/nfs/inode.c:523 #16 0x0811c256 in notify_change (dentry=3D0x47fb5b00, attr=3D0x4370fe1c) = at fs/attr.c:248 #17 0x081011bb in do_truncate (dentry=3D0x47fb5b00, length=3D463856500777= , time_attrs=3D5, filp=3D0x8609efc ) at fs/open.c:60 #18 0x081013f2 in do_sys_ftruncate (fd=3D108, length=3D32809, small=3D1) = at fs/open.c:190 #19 0x081016da in SYSC_ftruncate (length=3D, fd=3D) at fs/open.c:200 #20 SyS_ftruncate (fd=3D129, length=3D32809) at fs/open.c:198 #21 0x08062974 in handle_syscall (r=3D0x473c9fd4) at arch/um/kernel/skas/= syscall.c:35 #22 0x08074fa5 in handle_trap (local_using_sysemu=3D, regs= =3D, pid=3D) at arch/um/os-Linux/skas/proce= ss.c:198 #23 userspace (regs=3D0x473c9fd4) at arch/um/os-Linux/skas/process.c:431 #24 0x0805f740 in fork_handler () at arch/um/kernel/process.c:160 #25 0x00000000 in ?? () The fuzzer trinity is still running and tries to kill one of it childs=20 (the output comes from a ssh command, which started trinity in the UML): ... w[atchdog] sending SIGKILL to pid 4345. [diff:261] [watchdog] sending SIGKILL to pid 4346. [diff:263] [watchdog] sending SIGKILL to pid 4344. [diff:263] [watchdog] sending SIGKILL to pid 4345. [diff:266] [watchdog] sending SIGKILL to pid 4346. [diff:267] [watchdog] sending SIGKILL to pid 4344. [diff:267] [watchdog] sending SIGKILL to pid 4345. [diff:270] [watchdog] sending SIGKILL to pid 4346. [diff:271] [watchdog] sending SIGKILL to pid 4344. [diff:271] ... but I cannot connect to the UML via ssh. >> >> tfoerste@n22 ~/devel/linux $ sudo gdb /usr/local/bin/linux-v3.12-48-gb= e408cd 16619 -n -batch -ex bt >> 0x08296a8c in radix_tree_next_chunk (root=3D0x25, iter=3D0x462e7c64, f= lags=3D12) at lib/radix-tree.c:770 >> 770 if (node->slots[offset= ]) >> #0 0x08296a8c in radix_tree_next_chunk (root=3D0x25, iter=3D0x462e7c6= 4, flags=3D12) at lib/radix-tree.c:770 >> #1 0x080cc1fe in find_get_pages (mapping=3D0x462ad470, start=3D0, nr_= pages=3D14, pages=3D0xc) at mm/filemap.c:844 >> #2 0x080d5d6a in pagevec_lookup (pvec=3D0x462e7cc8, mapping=3D0x25, s= tart=3D37, nr_pages=3D37) at mm/swap.c:914 >> #3 0x080d615a in truncate_inode_pages_range (mapping=3D0x462ad470, ls= tart=3D0, lend=3D-1) at mm/truncate.c:241 >> #4 0x080d64ff in truncate_inode_pages (mapping=3D0x25, lstart=3D51539= 607589) at mm/truncate.c:358 >> >> >> >> >> tfoerste@n22 ~/devel/linux $ sudo gdb /usr/local/bin/linux-v3.12-48-gb= e408cd 16619 -n -batch -ex bt >> radix_tree_next_chunk (root=3D0x28, iter=3D0x462e7c64, flags=3D18) at = lib/radix-tree.c:769 >> 769 while (++offset < RADIX_TREE_M= AP_SIZE) { >> #0 radix_tree_next_chunk (root=3D0x28, iter=3D0x462e7c64, flags=3D18)= at lib/radix-tree.c:769 >> #1 0x080cc1fe in find_get_pages (mapping=3D0x462ad470, start=3D0, nr_= pages=3D14, pages=3D0x12) at mm/filemap.c:844 >> #2 0x080d5d6a in pagevec_lookup (pvec=3D0x462e7cc8, mapping=3D0x28, s= tart=3D40, nr_pages=3D40) at mm/swap.c:914 >> #3 0x080d615a in truncate_inode_pages_range (mapping=3D0x462ad470, ls= tart=3D0, lend=3D-1) at mm/truncate.c:241 >> #4 0x080d64ff in truncate_inode_pages (mapping=3D0x28, lstart=3D77309= 411368) at mm/truncate.c:358 >> #5 0x0825e388 in hostfs_evict_inode (inode=3D0x462ad3b8) at fs/hostfs= /hostfs_kern.c:242 >> #6 0x0811a8df in evict (inode=3D0x462ad3b8) at fs/inode.c:549 >> >> >=20 >=20 --=20 MfG/Sincerely Toralf F=C3=B6rster pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org