Re: kernel BUG at fs/ext4/inode.c:2982!

[Dave Jones]

On Thu, Oct 16, 2014 at 01:31:51PM +0400, Dmitry Monakhov wrote:
 > Dave Jones <davej@xxxxxxxxxx> writes:
 > 
 > > Just hit this on Linus' current tree while running my fuzz-tester.
 > > (No logs unfortunatly, so no idea what actually happened).
 > >
 > > kernel BUG at fs/ext4/inode.c:2982!
 > Looks
 > familiar.http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8086
 > Are you playing with fcntl?

Actually, I was mistaken, there was a partial log.

Pid that oopsed was 24261. Last two calls of that pid was..

[child10:24261] [125] sendfile(out_fd=672, in_fd=672, offset=0x1, count=0xce89) = -1 (Bad address)
[child10:24261] [126] sendfile(out_fd=672, in_fd=672, offset=0x0, count=0xa1f000) 

The second call was the one that oopsed.
No idea what fd 672 was unfortunatly. I'll have to add better logging of fd types.

At the same time that was running, other pids were also doing stuff with that same fd.

[child6:24355] [124] writev(fd=672, vec=0x1d2ec60, vlen=206) 
[child8:24515] [1498] lseek(fd=672, offset=-1, whence=0x2) 

Note that those calls also didn't complete, meaning they probably blocked on
some lock that the oopsing pid was holding.

So no recent fcntl's unless they were done before the last 2 syscalls each process did.

 > Try this patch http://www.spinics.net/lists/linux-ext4/msg45683.html

I'll give it a try if I can get it reproducing easily, otherwise I cna't say
either way whether the patch is doing any good.

	Dave

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/