Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1587906
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [GIT PULL] Block pull request for- 4.11-rc1 |
| Date | 2017-02-24 21:00 +0100 |
| Message-ID | <teuc2-4Ze-21@gated-at.bofh.it> (permalink) |
| References | (2 earlier) <tcKNX-6k2-5@gated-at.bofh.it> <tcQJH-1H7-3@gated-at.bofh.it> <tcZah-73r-21@gated-at.bofh.it> <tcZah-73r-19@gated-at.bofh.it> <tesjT-3yY-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Fri, Feb 24, 2017 at 9:39 AM, Bart Van Assche
<Bart.VanAssche@sandisk.com> wrote:
>
> So the crash is caused by an attempt to dereference address 0x6b6b6b6b6b6b6b6b
> at offset 0x270. I think this means the crash is caused by a use-after-free.
Yeah, that's POISON_FREE, and that might explain why you see crashes
that others don't - you obviously have SLAB poisoning enabled. Jens
may not have.
%rdi is "struct mapped_device *md", which came from dm_softirq_done() doing
struct dm_rq_target_io *tio = tio_from_request(rq);
struct request *clone = tio->clone;
int rw;
if (!clone) {
rq_end_stats(tio->md, rq);
rw = rq_data_dir(rq);
if (!rq->q->mq_ops)
blk_end_request_all(rq, tio->error);
else
blk_mq_end_request(rq, tio->error);
rq_completed(tio->md, rw, false);
return;
}
so it's the 'tio' pointer that has been free'd. But it's worth noting
that we did apparently successfully dereference "tio" earlier in that
dm_softirq_done() *without* getting the poison value, so what I think
might be going on is that the 'tio' thing gets free'd when the code
does the blk_end_request_all()/blk_mq_end_request() call.
Which makes sense - that ends the lifetime of the request, which in
turn also ends the lifetime of the "tio_from_request()", no?
So the fix may be as simple as just doing
if (!clone) {
struct mapped_device *md = tio->md;
rq_end_stats(md, rq);
...
rq_completed(md, rw, false);
return;
}
because the 'mapped_device' pointer hopefully is still valid, it's
just 'tio' that has been freed.
Jens? Bart? Christoph? Somebody who knows this code should
double-check my thinking above. I don't actually know the tio
lifetimes, I'm just going by looking at how earlier accesses seemed to
be fine (eg that "tio->clone" got us NULL, not a POISON_FREE pointer,
for example).
Linus
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-20 01:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-20 02:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-02-20 03:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-20 04:10 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-20 04:10 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Christoph Hellwig <hch@lst.de> - 2017-02-20 08:40 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-20 17:40 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-24 19:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-24 21:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-24 21:10 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-24 21:30 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 "hch@lst.de" <hch@lst.de> - 2017-02-25 19:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-25 19:30 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-21 20:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-21 20:40 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 00:10 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 00:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 00:30 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 19:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 19:30 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 19:50 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 20:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 20:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 20:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 22:40 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 20:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 19:50 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Markus Trippelsdorf <markus@trippelsdorf.de> - 2017-02-22 23:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 23:00 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-23 01:20 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2017-02-22 19:50 +0100
Re: [GIT PULL] Block pull request for- 4.11-rc1 Jens Axboe <axboe@kernel.dk> - 2017-02-22 19:50 +0100
csiph-web