lkml.org 
[lkml]   [2018]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [rds-devel] BUG: unable to handle kernel NULL pointer dereference in rds_send_xmit
On Mon, Dec 18, 2017 at 12:22:51PM -0500, Sowmini Varadhan wrote:
> > From: Santosh Shilimkar <santosh.shilimkar@oracle.com>
> > Date: Mon, 18 Dec 2017 08:28:05 -0800
> :
> > > Looks like another one tripping on empty transport. Mostly below
> > > should
> > > address it but we will test it if it does.
>
> that was my first thought, but it cannot be the case here: rds_sendmsg
> etc itself would have bombed if that were the case, and the packet
> would never have gotten queued.
>
> This is unlike f3069c6d33, where an applications skips the transport
> binding (either misses the explicit bind, or gets the wrong transport
> due to an implicit bind) before it triggers the setsockopt.
>
> I suspect that the problems is that the conn (and thus c_trans)
> have gotten destroyed, but the cp_send_w work got incorrectly
> re-queued. For example, rds_cong_queue_updates() (because the
> peer sent a congestion update) can happen in softirq context,
> and would end up requeing work in the middle of rds_conn_destroy,
> after we have assumed that everything is quisced.
>
> On (12/18/17 12:12), David Miller wrote:
> >
> > We're seeming to accumulate a lot of checks like this, maybe there
> > is a more general way to deal with this problem?
>
> Yeah, I was thinking about this.. let me try to reprodcue this in-house
> and get back with a patchset.
>

I assume you weren't able to reproduce this? This crash hasn't been seen again,
and it was reported while KASAN was accidentally disabled in the syzbot kconfig
due to a change to the kconfig menus in linux-next. So this crash was possibly
caused by slab corruption elsewhere.

I am invalidating the bug for syzbot so it will report the same crash signature
again if it occurs, but if you think there is a real bug feel free to keep
looking into it.

#syz invalid

Thanks,

Eric

\
 
 \ /
  Last update: 2018-01-30 23:23    [W:0.092 / U:0.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site