Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752692AbaDUQh1 (ORCPT ); Mon, 21 Apr 2014 12:37:27 -0400 Received: from mx1.redhat.com ([209.132.183.28]:48406 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751318AbaDUQhX (ORCPT ); Mon, 21 Apr 2014 12:37:23 -0400 Date: Mon, 21 Apr 2014 11:50:20 -0400 From: Dave Jones To: Miklos Szeredi , Al Viro , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH] vfs: rw_copy_check_uvector() - free iov on error Message-ID: <20140421155020.GB13709@redhat.com> Mail-Followup-To: Dave Jones , Miklos Szeredi , Al Viro , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org References: <20140415145749.GF10187@tucsk.piliscsaba.szeredi.hu> <20140416180422.GA20907@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140416180422.GA20907@redhat.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 16, 2014 at 02:04:22PM -0400, Dave Jones wrote: > On Tue, Apr 15, 2014 at 04:57:49PM +0200, Miklos Szeredi wrote: > > > Some callers (aio_run_iocb, vmsplice_to_user) forget to free the iov on > > error. This seems to be a recurring problem, with most callers being buggy > > initially. > > Your patch looks a lot more complete than the quick hack I did a few > days ago when coverity first started nagging about this, but in testing > I've found that something really ugly starts showing up when you patch this > > The symptoms vary, but always are some kind of slab corruption. > Here's the last example: > > ============================================================================= > BUG kmalloc-256 (Not tainted): Invalid object pointer 0xffff8802407adc60 > ----------------------------------------------------------------------------- > > Disabling lock debugging due to kernel taint > INFO: Slab 0xffffea000901eb00 objects=28 used=22 fp=0xffff8802407ad6d0 flags=0x20000000004081 > CPU: 1 PID: 1185 Comm: trinity-c1 Tainted: G B 3.15.0-rc1+ #191 > ffff880243c073c0 00000000f952f249 ffff8800a1a2bc10 ffffffffbd74686d > ffffea000901eb00 ffff8800a1a2bce8 ffffffffbd1b0cd4 ffffffff00000020 > ffff8800a1a2bcf8 ffff8800a1a2bca8 61766e4943c00a18 656a626f2064696c > Call Trace: > [] dump_stack+0x4e/0x7a > [] slab_err+0xb4/0xe0 > [] ? put_lock_stats.isra.23+0xe/0x30 > [] ? slab_pad_check.part.44+0xa6/0x170 > [] free_debug_processing+0x88/0x22a > [] ? compat_do_readv_writev+0xe1/0x250 > [] __slab_free+0x4c/0x2c3 > [] ? do_sync_readv_writev+0x59/0xa0 > [] kfree+0x214/0x220 > [] ? compat_do_readv_writev+0xe1/0x250 > [] compat_do_readv_writev+0xe1/0x250 > [] ? lock_release_holdtime.part.24+0xe6/0x160 > [] ? get_parent_ip+0xd/0x50 > [] ? preempt_count_sub+0x6b/0xf0 > [] ? _raw_spin_unlock+0x31/0x50 > [] ? __this_cpu_preempt_check+0x13/0x20 > [] compat_writev+0x3a/0x80 > [] compat_SyS_writev+0x58/0xd0 > [] ia32_do_call+0x13/0x13 > FIX kmalloc-256: Object at 0xffff8802407adc60 not freed > > > I also had an incomplete trace that showed vmsplice causing a bug in mm/slub.c:3396 > on an earlier run. > > The crash happens very quickly (within a few seconds of running trinity) for me. Al, Miklos ? Dave -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/