Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754405AbaAULj5 (ORCPT ); Tue, 21 Jan 2014 06:39:57 -0500 Received: from e8.ny.us.ibm.com ([32.97.182.138]:47181 "EHLO e8.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754099AbaAULjy (ORCPT ); Tue, 21 Jan 2014 06:39:54 -0500 From: Raghavendra K T To: Alexander Viro , Matias Bjorling , Jens Axboe , Andrew Morton , Yuanhan Liu , "Darrick J. Wong" , Jan Kara , Johannes Weiner , Zhang Yanfei , Jeff Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Raghavendra K T , Sumanth Subject: [RFC PATCH V3 0/2] Fix null pointer deference problem Date: Tue, 21 Jan 2014 16:59:58 +0530 Message-Id: <1390303800-22422-1-git-send-email-raghavendra.kt@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.11.7 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 14012111-0320-0000-0000-0000023E6257 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When we load null_blk with bs > PAGE_SIZE we get oops like below. This patch series fixes that. Also we add some sanity check for the cases where bs > PAGE_SIZE causes problem. full oops: [ 3819.812190] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 3819.812387] IP: [] create_empty_buffers+0x28/0xaf [ 3819.812527] PGD 219244067 PUD 215a06067 PMD 0 [ 3819.812640] Oops: 0000 [#1] SMP [ 3819.812772] Modules linked in: null_blk(+) [ 3819.812872] CPU: 8 PID: 1179 Comm: modprobe Not tainted 3.13.0-rc6+ #144 [ 3819.813008] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007 [ 3819.813071] task: ffff8800376add40 ti: ffff8800374c8000 task.ti: ffff8800374c8000 [ 3819.813071] RIP: 0010:[] [] create_empty_buffers+0x28/0xaf [ 3819.813071] RSP: 0018:ffff8800374c9758 EFLAGS: 00010292 [ 3819.813071] RAX: 0000000000000000 RBX: ffffea000368e200 RCX: 000000000000000d [ 3819.813071] RDX: 0000000000000000 RSI: 0000000000002000 RDI: ffffea000368e200 [ 3819.813071] RBP: ffff8800374c9778 R08: 0000000000000000 R09: 0000000000003012 [ 3819.813071] R10: 0000000000003012 R11: ffff8800dbad0240 R12: 0000000000000000 [ 3819.813071] R13: 0000000000000000 R14: 00000000000201d0 R15: 0000000000000000 [ 3819.813071] FS: 00007fa0f79dd700(0000) GS:ffff88011bd00000(0000) knlGS:0000000000000000 [ 3819.813071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3819.813071] CR2: 0000000000000008 CR3: 0000000215b0e000 CR4: 00000000000407e0 [ 3819.813071] Stack: [ 3819.813071] 0000000000003012 ffffea000368e200 ffffea000368e200 0000000000000000 [ 3819.813071] ffff8800374c9798 ffffffff81171047 0000000000016378 ffff8800dbad0240 [ 3819.813071] ffff8800374c9848 ffffffff81172deb 00000000000201d0 ffff8800376add40 [ 3819.813071] Call Trace: [ 3819.813071] [] create_page_buffers+0x36/0x48 [ 3819.813071] [] block_read_full_page+0x38/0x1ed [ 3819.813071] [] ? I_BDEV+0xd/0xd [ 3819.813071] [] ? __inc_zone_page_state+0x1e/0x20 [ 3819.813071] [] ? get_page+0x24/0x29 [ 3819.813071] [] ? __lru_cache_add+0x24/0x44 [ 3819.813071] [] blkdev_readpage+0x18/0x1a [ 3819.813071] [] do_read_cache_page+0x88/0x12c [ 3819.813071] [] ? zone_statistics+0x7c/0x83 [ 3819.813071] [] ? blkdev_write_begin+0x25/0x25 [ 3819.813071] [] read_cache_page_async+0x19/0x1b [ 3819.813071] [] read_cache_page+0xe/0x18 [ 3819.813071] [] read_dev_sector+0x2d/0x85 [ 3819.813071] [] read_lba+0x81/0xdd [ 3819.813071] [] ? find_valid_gpt+0x9a/0x51d [ 3819.813071] [] find_valid_gpt+0xb8/0x51d [ 3819.813071] [] efi_partition+0x6c/0x38e [ 3819.813071] [] ? vsnprintf+0x81/0x3d6 [ 3819.813071] [] ? snprintf+0x34/0x36 [ 3819.813071] [] check_partition+0x113/0x1cd [ 3819.813071] [] rescan_partitions+0xc1/0x2a7 [ 3819.813071] [] __blkdev_get+0x1bd/0x3e3 [ 3819.813071] [] blkdev_get+0x1df/0x2d8 [ 3819.813071] [] ? unlock_new_inode+0x5c/0x61 [ 3819.813071] [] ? put_device+0x17/0x19 [ 3819.813071] [] ? disk_put_part+0x12/0x14 [ 3819.813071] [] add_disk+0x2af/0x3f0 [ 3819.813071] [] null_init+0x3a4/0x3e5 [null_blk] [ 3819.813071] [] ? 0xffffffffa0002fff [ 3819.813071] [] do_one_initcall+0xb3/0x154 [ 3819.813071] [] ? __blocking_notifier_call_chain+0x56/0x60 [ 3819.813071] [] load_module+0x1c4f/0x1f92 [ 3819.813071] [] ? show_initstate+0x47/0x47 [ 3819.813071] [] SyS_init_module+0xc7/0xc9 [ 3819.813071] [] system_call_fastpath+0x16/0x1b [ 3819.813071] Code: 5f 5d c3 66 66 66 66 90 55 48 89 e5 41 55 41 54 49 89 d4 ba 01 00 00 00 53 48 89 fb 41 52 e8 3b ff ff ff 49 89 c5 eb 03 48 89 d0 <48> 8b 50 08 4c 09 20 48 85 d2 75 f1 4c 89 68 08 48 8b 7b 08 4d [ 3819.813071] RIP [] create_empty_buffers+0x28/0xaf [ 3819.813071] RSP [ 3819.813071] CR2: 0000000000000008 [ 3819.837847] ---[ end trace e3c8b9f8f8af88d6 ]--- I would like to thank Matias and Jeff for their vaulable comments. Changes in V3: - split patch, Change warning format (Matias) - Add more description for null pointer check (Matias) Changes in V2: - Change hardcode 4k to PAGE_SIZE (Jeff, Matias) - use pr_warn and move bs setting to null_init (Matias) - Move bs > PAGE_SIZE to bd_set_size based on Matias' suggestion. Your suggestion/Comments welcome. Raghavendra K T (2): null_blk: Null pointer deference problem in alloc_page_buffers fs : Add sanity checks for block size > PAGE_SIZE drivers/block/null_blk.c | 5 +++++ fs/block_dev.c | 1 + fs/buffer.c | 6 ++++++ 3 files changed, 12 insertions(+) -- 1.7.11.7 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/