lkml.org 
[lkml]   [2000]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectbug in blkdev <-> VFS interaction. (oops)
Hi Alexander,

I have just found an interesting bug. Try mounting read/write a
write-protected floppy in 2.4.0-test6-pre5 (probably also other
kernels). The oops is attached.

The reason is quite clear. When blkdev_get() calls block device open
routine it passes a fake_inode as 'inode' argument and therefore it's
inode->i_sb is not set because it is not known yet (sb=read_super()
happens later than blkdev_get() in get_sb_bdev()). Now, the device open
routine, for example drivers/block/floppy.c:floppy_open() is free to call
permission(inode, mask) on that inode which will in turn do
IS_RDONLY(inode) which dereferences inode->i_sb->s_flags off NULL
inode->i_sb - hence the oops.

So, it looks like to get a bdev we need to blkdev_get it which needs a
superblock but to get a superblock we need a bdev. What do we do?

Regards,
Tigran
ksymoops 0.7c on i686 2.4.0-test6. Options used
-V (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.4.0-test6/ (default)
-m /usr/src/linux/System.map (default)

Warning: You did not tell me where to find symbol information. I will
assume that the log matches the kernel and modules that are running
right now and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc. ksymoops -h explains the options.

Reading Oops report from the terminal
Unable to handle kernel NULL pointer dereference at virtual address 00000020
c013cadf
*pde = 00000000
Oops: 0000
CPU: 1
EIP: 0010:[<c013cadf>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010202
eax: 00000000 ebx: 0000c1ff ecx: f777c560 edx: 00000002
esi: 00000000 edi: f777c560 ebp: 00000000 esp: f7739dc8
ds: 0018 es: 0018 ss: 0018
Process mount (pid: 764, stackpage=f7739000)
Stack: 00000200 00000000 f777c560 00000000 c0187646 f777c560 00000002 00000200
00000000 f777c560 f7c94d60 00000000 00000000 00000000 c0139b5f f777c560
f7739e9c 00000001 fffffff3 00000200 f7c94d60 f7739e9c f7739e2c f7c94d78
Call Trace: [<c0187646>] [<c0139b5f>] [<c0137745>] [<c0138350>] [<c0138154>] [<c013851f>] [<c010ad2c>]
Code: f6 40 20 01 74 2b 89 d8 25 00 f0 00 00 3d 00 80 00 00 74 0e

>>EIP; c013cadf <permission+cf/18c> <=====
Trace; c0187646 <floppy_open+322/408>
Trace; c0139b5f <blkdev_get+df/124>
Trace; c0137745 <get_sb_bdev+f9/194>
Trace; c0138350 <do_mount+1ac/2cc>
Trace; c0138154 <copy_mount_options+50/a0>
Trace; c013851f <sys_mount+af/120>
Trace; c010ad2c <system_call+34/38>
Code; c013cadf <permission+cf/18c>
00000000 <_EIP>:
Code; c013cadf <permission+cf/18c> <=====
0: f6 40 20 01 testb $0x1,0x20(%eax) <=====
Code; c013cae3 <permission+d3/18c>
4: 74 2b je 31 <_EIP+0x31> c013cb10 <permission+100/18c>
Code; c013cae5 <permission+d5/18c>
6: 89 d8 mov %ebx,%eax
Code; c013cae7 <permission+d7/18c>
8: 25 00 f0 00 00 and $0xf000,%eax
Code; c013caec <permission+dc/18c>
d: 3d 00 80 00 00 cmp $0x8000,%eax
Code; c013caf1 <permission+e1/18c>
12: 74 0e je 22 <_EIP+0x22> c013cb01 <permission+f1/18c>


1 warning issued. Results may not be reliable.
\
 
 \ /
  Last update: 2005-03-22 13:58    [W:0.031 / U:0.692 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site