lkml.org 
[lkml]   [2005]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: 2.6.12-rc6-mm1 oops on startup.
James Courtier-Dutton <James@superbug.demon.co.uk> wrote:
>
> I have used the kernel.org normal kernel, and it compiles and boots fine.
> I then use exactly the same .config file for the 2.6.12-rc6-mm1 and it
> fails to boot.

It's due to the fork notifier code. Set CONFIG_FORK_CONNECTOR=n and you
should be OK.

The oops is detected by CONFIG_DEBUG_PAGEALLOC. It's good that you're
running with CONFIG_DEBUG_PAGEALLOC, but be aware that it uses tons of
memory and will slow down smaller machines quite a lot.


Here:

if (clone_flags & CLONE_VFORK) {
wait_for_completion(&vfork);
if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE))
ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
}
fork_connector(current->tgid, current->pid,
p->tgid, p->pid);

Someone does a call_usermodehelper() which uses CLONE_VFORK. The new
process at `p' exits quickly so when the parent returns from
wait_for_completion() it is left with freed memory at *p. When the parent
tries to reference p->pid we oops due to the use-after-free bug.

Guillaume, I'll do this for now:

--- 25/kernel/fork.c~connector-add-a-fork-connector-use-after-free-fix 2005-06-21 23:46:35.000000000 -0700
+++ 25-akpm/kernel/fork.c 2005-06-21 23:46:58.000000000 -0700
@@ -1248,14 +1248,15 @@ long do_fork(unsigned long clone_flags,
ptrace_notify ((trace << 8) | SIGTRAP);
}

+ fork_connector(current->tgid, current->pid, p->tgid, p->pid);
+
if (clone_flags & CLONE_VFORK) {
+
wait_for_completion(&vfork);
if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE))
- ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
+ ptrace_notify((PTRACE_EVENT_VFORK_DONE << 8) |
+ SIGTRAP);
}
-
- fork_connector(current->tgid, current->pid,
- p->tgid, p->pid);
} else {
free_pidmap(pid);
pid = PTR_ERR(p);
_

But you need to work out what semantics you want for vfork()?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-06-22 10:06    [from the cache]
©2003-2011 Jasper Spaans