Messages in this thread | | | Date | Sat, 16 May 2009 18:28:13 +0200 | From | Luca Tettamanti <> | Subject | [2.6.30-rc6] cifs_close: NULL pointer dereference |
| |
Hello, I just hit a NULL pointer dereference in cifs_close while accessing a file on a remote Samba shared directory. The bug is reproducible, a simple: touch foo; cat foo is suffient to cause the OOPS. The machine is running kernel from git (1d80cac - almost rc6), SMP w/ PREEMP. The remote server is running Samba 3.3.3. I don't use CIFS frequently, but at some point it was certainly working; I can try a bisection if you want.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [<ffffffffa05f105c>] cifs_close+0x1c1/0x2e8 [cifs] PGD 9205f067 PUD 8f56c067 PMD 0 Oops: 0002 [#1] PREEMPT SMP last sysfs file: /sys/devices/platform/coretemp.0/temp1_input CPU 0 Modules linked in: nls_iso8859_1 cifs radeon drm i2c_core af_packet binfmt_misc rfcomm l2cap kvm_intel kvm ipv6 acpi_cpufreq cpufreq_userspace cpufreq_stats cpufreq_conservative cpufreq_powersave cpufreq_ondemand freq_table deflate zlib_deflate twofish_x86_64 twofish_common aes_x86_64 aes_generic blowfish des_generic cbc sha256_generic sha1_generic af_key ext3 jbd coretemp hwmon microcode loop arc4 snd_hda_codec_realtek ecb btusb snd_hda_intel snd_hda_codec iwlagn bluetooth snd_hwdep iwlcore snd_pcm snd_seq rfkill snd_timer snd_seq_device mac80211 snd video soundcore snd_page_alloc psmouse cfg80211 pcspkr evdev asus_laptop output rtc_cmos rtc_core rtc_lib processor battery ac button ext4 mbcache jbd2 crc16 usbhid hid dm_mod sg sd_mod sr_mod cdrom ahci ata_piix ohci1394 sdhci_pci sdhci ieee1394 mmc_core led_class uhci_hcd libata scsi_mod ehci_hcd intel_agp usbcore thermal fan unix Pid: 17851, comm: cat Not tainted 2.6.30-rc5-00112-g1d80cac #110 F3Sa RIP: 0010:[<ffffffffa05f105c>] [<ffffffffa05f105c>] cifs_close+0x1c1/0x2e8 [cifs] RSP: 0018:ffff880098537e88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8800bdbe7100 RCX: ffff880098537e08 RDX: 0000000000000000 RSI: 00000000fffffff7 RDI: ffffffffa0616bc4 RBP: ffff880098537ec8 R08: ffff88009573c870 R09: ffff88009227c940 R10: ffff880098537c58 R11: ffff88008f65dad0 R12: 0000000000000000 R13: 000000000000000a R14: 0000000000000000 R15: ffff8800bdbe7170 FS: 00007f7e12bba6f0(0000) GS:ffff88000101c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000008 CR3: 000000008f589000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process cat (pid: 17851, threadinfo ffff880098536000, task ffff88008f4c2b80) Stack: ffff8800922b5900 ffff88006e019008 00000c216e0191f0 0000000000000010 ffff88006e019008 ffff8800922b5900 ffff88006e019008 ffff8800be725100 ffff880098537f08 ffffffff802ad55f ffff88006e0cdc00 ffff8800922b5900 Call Trace: [<ffffffff802ad55f>] __fput+0xeb/0x1ac [<ffffffff802ad638>] fput+0x18/0x1a [<ffffffff802aa94c>] filp_close+0x67/0x72 [<ffffffff802aa9fc>] sys_close+0xa5/0xe4 [<ffffffff8020bbab>] system_call_fastpath+0x16/0x1b Code: 89 ef 45 31 e4 e8 f3 63 e7 df 41 bd 0a 00 00 00 48 c7 c7 c4 6b 61 a0 e8 b3 7f e7 df 48 8b 53 10 48 8b 43 18 48 c7 c7 c4 6b 61 a0 <48> 89 42 08 48 89 10 48 c7 43 18 00 02 20 00 48 8b 13 48 8b 43 RIP [<ffffffffa05f105c>] cifs_close+0x1c1/0x2e8 [cifs] RSP <ffff880098537e88> CR2: 0000000000000008 ---[ end trace c92994e7fd5bf7a2 ]--- note: cat[17851] exited with preempt_count 1
| |