lkml.org 
[lkml]   [2017]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [vlan_device_event] BUG: unable to handle kernel paging request at 6b6b6ccf
On Tue, Nov 07, 2017 at 08:25:03AM -0800, Linus Torvalds wrote:
>On Tue, Nov 7, 2017 at 2:21 AM, Fengguang Wu <fengguang.wu@intel.com> wrote:
>>
>> FYI this happens in v4.14-rc8 -- it's not necessarily a new bug.
>
>Probably not.
>
>Looks like a use-after-free bug in vlan_device_event() judging by the
>base pointer:
>
> ECX: 6b6b6b6b
>
>this is one of those circumstances where having the faddr2line output
>for that EIP would make it much easier to see exactly which access it
>is that causes problems. There's lots of inlining going on, so without
>that it's a pain to figure out.
>
>The code is
>
> 0: 31 c0 xor %eax,%eax
> 2: 8d 76 00 lea 0x0(%esi),%esi
> 5: 89 c2 mov %eax,%edx
> 7: 89 c3 mov %eax,%ebx
> 9: 81 e2 ff 0f 00 00 and $0xfff,%edx
> f: 89 d1 mov %edx,%ecx
> 11: c1 fb 0c sar $0xc,%ebx
> 14: c1 e9 09 shr $0x9,%ecx
> 17: 8d 0c d9 lea (%ecx,%ebx,8),%ecx
> 1a: 8b 4c 8e 10 mov 0x10(%esi,%ecx,4),%ecx
> 1e: 85 c9 test %ecx,%ecx
> 20: 74 34 je 0x56
> 22: 81 e2 ff 01 00 00 and $0x1ff,%edx
> 28:* 8b 14 91 mov (%ecx,%edx,4),%edx <-- trapping instruction
> 2b: 85 d2 test %edx,%edx
> 2d: 74 27 je 0x56
> 2f: f6 82 30 01 00 00 01 testb $0x1,0x130(%edx)
> 36: 74 1e je 0x56
>
>and just by going by the constants in question (0xfff and 0x1ff), I
>can see that it's one of
>
> vlan_group_for_each_dev(..) {
> ...
> }
>
>things, but that's pretty much all I can tell.
>
>Apparently we'll get that faddr2line output soon. In the meantime, I
>think this is a real bug report but I don't see enough information to
>really go on.

Got it. I should be able to get faddr2line output tomorrow.

>Of course, if it's bisectable, that would be great too.

It looks reproducible enough to be bisectable. I'll try.

Regards,
Fengguang

\
 
 \ /
  Last update: 2017-11-08 21:06    [W:0.288 / U:2.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site