Messages in this thread | | | Date | Sun, 6 Aug 2000 20:06:41 +0100 (BST) | From | Tigran Aivazian <> | Subject | bug in blkdev <-> VFS interaction. (oops) |
| |
Hi Alexander,
I have just found an interesting bug. Try mounting read/write a write-protected floppy in 2.4.0-test6-pre5 (probably also other kernels). The oops is attached.
The reason is quite clear. When blkdev_get() calls block device open routine it passes a fake_inode as 'inode' argument and therefore it's inode->i_sb is not set because it is not known yet (sb=read_super() happens later than blkdev_get() in get_sb_bdev()). Now, the device open routine, for example drivers/block/floppy.c:floppy_open() is free to call permission(inode, mask) on that inode which will in turn do IS_RDONLY(inode) which dereferences inode->i_sb->s_flags off NULL inode->i_sb - hence the oops.
So, it looks like to get a bdev we need to blkdev_get it which needs a superblock but to get a superblock we need a bdev. What do we do?
Regards, Tigran ksymoops 0.7c on i686 2.4.0-test6. Options used -V (default) -k /proc/ksyms (default) -l /proc/modules (default) -o /lib/modules/2.4.0-test6/ (default) -m /usr/src/linux/System.map (default)
Warning: You did not tell me where to find symbol information. I will assume that the log matches the kernel and modules that are running right now and I'll use the default options above for symbol resolution. If the current kernel and/or modules do not match the log, you can get more accurate output by telling me the kernel version and where to find map, modules, ksyms etc. ksymoops -h explains the options.
Reading Oops report from the terminal Unable to handle kernel NULL pointer dereference at virtual address 00000020 c013cadf *pde = 00000000 Oops: 0000 CPU: 1 EIP: 0010:[<c013cadf>] Using defaults from ksymoops -t elf32-i386 -a i386 EFLAGS: 00010202 eax: 00000000 ebx: 0000c1ff ecx: f777c560 edx: 00000002 esi: 00000000 edi: f777c560 ebp: 00000000 esp: f7739dc8 ds: 0018 es: 0018 ss: 0018 Process mount (pid: 764, stackpage=f7739000) Stack: 00000200 00000000 f777c560 00000000 c0187646 f777c560 00000002 00000200 00000000 f777c560 f7c94d60 00000000 00000000 00000000 c0139b5f f777c560 f7739e9c 00000001 fffffff3 00000200 f7c94d60 f7739e9c f7739e2c f7c94d78 Call Trace: [<c0187646>] [<c0139b5f>] [<c0137745>] [<c0138350>] [<c0138154>] [<c013851f>] [<c010ad2c>] Code: f6 40 20 01 74 2b 89 d8 25 00 f0 00 00 3d 00 80 00 00 74 0e
>>EIP; c013cadf <permission+cf/18c> <===== Trace; c0187646 <floppy_open+322/408> Trace; c0139b5f <blkdev_get+df/124> Trace; c0137745 <get_sb_bdev+f9/194> Trace; c0138350 <do_mount+1ac/2cc> Trace; c0138154 <copy_mount_options+50/a0> Trace; c013851f <sys_mount+af/120> Trace; c010ad2c <system_call+34/38> Code; c013cadf <permission+cf/18c> 00000000 <_EIP>: Code; c013cadf <permission+cf/18c> <===== 0: f6 40 20 01 testb $0x1,0x20(%eax) <===== Code; c013cae3 <permission+d3/18c> 4: 74 2b je 31 <_EIP+0x31> c013cb10 <permission+100/18c> Code; c013cae5 <permission+d5/18c> 6: 89 d8 mov %ebx,%eax Code; c013cae7 <permission+d7/18c> 8: 25 00 f0 00 00 and $0xf000,%eax Code; c013caec <permission+dc/18c> d: 3d 00 80 00 00 cmp $0x8000,%eax Code; c013caf1 <permission+e1/18c> 12: 74 0e je 22 <_EIP+0x22> c013cb01 <permission+f1/18c>
1 warning issued. Results may not be reliable.
| |