From: Alex Elder <elder@ieee.org>
To: CSa <salzmann@mi.fu-berlin.de>, ceph-devel@vger.kernel.org
Subject: Re: kernel BUG at .../fs/ceph/xattr.c:287!
Date: Tue, 19 May 2015 07:50:13 -0500 [thread overview]
Message-ID: <555B3185.8010304@ieee.org> (raw)
In-Reply-To: <mjfatn$c1e$1@ger.gmane.org>
On 05/19/2015 07:39 AM, CSa wrote:
> Hi,
>
> we are encountering a bug in the cephfs client kernel module:
>
>
> May 18 11:02:04 allegro kernel: [1020094.145209] ------------[ cut here
> ]------------
> May 18 11:02:04 allegro kernel: [1020094.149127] kernel BUG at /build/linux-
> RGM_Ed/linux-3.16.7-ckt9/fs/ceph/xattr.c:287!
> May 18 11:02:04 allegro kernel: [1020094.149127] invalid opcode: 0000 [#1]
> SMP
> [...]
> May 18 11:02:04 allegro kernel: [1020094.149127] CPU: 2 PID: 1359 Comm: mv
> Not tainted 3.16.0-4-amd64 #1 Debian 3.16.7-ckt9-3~deb8u1
> [...]
>
> (see full log at http://paste.debian.net/180292)
Based on a quick look at the code, I think this must be
a use-after-free.
The bug occurs if ceph_vxattrs_name_size() is given a non-NULL
vxattrs pointer that is neither ceph_dir_vxattrs nor ceph_file_vxattrs.
There is only one caller of ceph_vxattrs_name_size(), and it is
passed a value that's a result of a call to ceph_inode_vxattrs().
That function returns only three possible values: ceph_dir_vxattrs,
ceph_file_vxattrs, or NULL.
-Alex
>
> has anybody been hit by this so far?
>
> ciao
> Christian
>
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
next prev parent reply other threads:[~2015-05-19 12:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-19 12:39 kernel BUG at .../fs/ceph/xattr.c:287! CSa
2015-05-19 12:50 ` Alex Elder [this message]
2015-05-19 13:10 ` Ilya Dryomov
2015-05-19 13:21 ` Christian Salzmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=555B3185.8010304@ieee.org \
--to=elder@ieee.org \
--cc=ceph-devel@vger.kernel.org \
--cc=salzmann@mi.fu-berlin.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.