Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1291517 > unrolled thread

Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0 Dave Chinner <david@fromorbit.com> - 2015-12-14 21:00 +0100
    Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0 Andrea Gelmini <andrea.gelmini@gelma.net> - 2015-12-14 21:20 +0100
      Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0 Dave Chinner <david@fromorbit.com> - 2015-12-14 22:30 +0100
        Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0 Andrea Gelmini <andrea.gelmini@gelma.net> - 2015-12-15 10:20 +0100

#1291517 — Re: BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0

On Mon, Dec 14, 2015 at 07:00:48PM +0100, Andrea Gelmini wrote:
> Hi everybody,
>    using dev kernel v4.4, I have this:
> 
> [40240.371807] ==================================================================
> [40240.371826] BUG: KASAN: use-after-free in xfs_iflush_cluster+0x9d7/0xaf0 at addr ffff88001ed15428
> [40240.371832] Read of size 4 by task xfsaild/dm-0/332
> [40240.371834] =============================================================================
> [40240.371839] BUG xfs_ili (Tainted: G    B          ): kasan: bad access detected
> [40240.371842] -----------------------------------------------------------------------------
.....

What line of code does this address correspond to in your kernel?

	xfs_iflush_cluster+0x9d7

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1291525

[Multipart message — attachments visible in raw view] — view raw

On Tue, Dec 15, 2015 at 06:54:22AM +1100, Dave Chinner wrote:
> What line of code does this address correspond to in your kernel?
> 
> 	xfs_iflush_cluster+0x9d7

gelma@glen:~/dev/kernel/v4.4.x$ git grep -Iin xfs_iflush_cluster
fs/xfs/xfs_inode.c:3179:xfs_iflush_cluster(
fs/xfs/xfs_inode.c:3414:	error = xfs_iflush_cluster(ip, bp);


Thanks a lot for your quick answer,
Andrea

[toc] | [prev] | [next] | [standalone]

#1291587

On Mon, Dec 14, 2015 at 09:15:26PM +0100, Andrea Gelmini wrote:
> On Tue, Dec 15, 2015 at 06:54:22AM +1100, Dave Chinner wrote:
> > What line of code does this address correspond to in your kernel?
> > 
> > 	xfs_iflush_cluster+0x9d7
> 
> gelma@glen:~/dev/kernel/v4.4.x$ git grep -Iin xfs_iflush_cluster
> fs/xfs/xfs_inode.c:3179:xfs_iflush_cluster(
> fs/xfs/xfs_inode.c:3414:	error = xfs_iflush_cluster(ip, bp);

If that was what I needed, I wouldn't have needed to ask. :/

I need the translation of the memory address to line number, not the
line number of function call. This requires translation from your
built kernel object file. e.g. on a kernel I just built:

$ gdb vmlinux
....
(gdb) l *(xfs_iflush_cluster+0x9d7)
0xffffffff814df647 is in xfs_bulkstat_one_int (fs/xfs/xfs_itable.c:110).
105             buf->bs_dmevmask = dic->di_dmevmask;
106             buf->bs_dmstate = dic->di_dmstate;
107             buf->bs_aextents = dic->di_anextents;
108             buf->bs_forkoff = XFS_IFORK_BOFF(ip);
109
110             switch (dic->di_format) {
111             case XFS_DINODE_FMT_DEV:
112                     buf->bs_rdev = ip->i_df.if_u2.if_rdev;
113                     buf->bs_blksize = BLKDEV_IOSIZE;
114                     buf->bs_blocks = 0;

That's clearly not code in xfs_iflush_cluster() or any function that
xfs_iflush_cluster() calls. Indeed, xfs_iflush_cluster() is only
0x411 bytes long on that kernel, so there's more than 2x the amount
of code in that function in your instrumented kernel than mine.

Hence I need the address-to-line number translation from your kernel
to tell me what line of code is being tripped over.

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1291964

[Multipart message — attachments visible in raw view] — view raw

On Tue, Dec 15, 2015 at 08:22:20AM +1100, Dave Chinner wrote:
> $ gdb vmlinux
> ....
> (gdb) l *(xfs_iflush_cluster+0x9d7)

It's not working. Shame on me, I forgot to set "Compile the kernel with debug info".

I'm recompiling, to try it again.
Maybe, in the meanwhile, you can do something with my files. You can find 'em here:
http://mail.gelma.net/xfs_kasan

Thanks a lot,
Andrea

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web