From: ankijain@codeaurora.org
To: linux-ext4@vger.kernel.org
Subject: Kernel panic in ext4_ext_drop_refs
Date: Mon, 11 Sep 2017 10:40:23 +0530 [thread overview]
Message-ID: <c5d90b6ba6826fb0d6ab245befdfc405@codeaurora.org> (raw)
Hi
We are facing issue use after free/un-initialized in ext4 delayed
allocation path for write request to a file.
Details:
machine arm64
kernel : 4.9.40
Issue detail:
Panic is occurred while accessing uninitialized/free path variable
inside ext4_ext_drop_refs()
ext4_ext_drop_refs(
path = 0xFFFFFFC757A85C00 -> (
p_block = 0x6B6B6B6B6B6B6B6B,
p_depth = 0x6B6B,
p_maxdepth = 0x6B6B,
p_ext = 0x6B6B6B6B6B6B6B6B,
p_idx = 0x6B6B6B6B6B6B6B6B,
p_hdr = 0x6B6B6B6B6B6B6B6B,
p_bh = 0x6B6B6B6B6B6B6B6B))
This path variable is representing extent path from root extent to leaf
of requested logical block of file.
we have allocated memory for this path variable inside
ext4_find_extent() locally and trying to free it inside
ext4_ext_drop_refs().
http://elixir.free-electrons.com/linux/v4.9.40/source/fs/ext4/extents.c#L894
----> allocation happen without any error.
http://elixir.free-electrons.com/linux/v4.9.40/source/fs/ext4/extents.c#L4620
----> trying to free previously allocated memory.
Device is running in low memory condition.
PAGES TOTAL PERCENTAGE
FREE 6720 26.2 MB 0% of TOTAL MEM
could anyone help us to find, in which scenario this path variable can
get free/uninitialized before ext4_ext_drop_refs()?
Unable to handle kernel paging request at virtual address 6b6b6b6b6b6bcb
<1>[ 4072.876804] pgd = ffffffc7b6c91000
<1>[ 4072.885604] [6b6b6b6b6b6bcb] *pgd=0000000000000000
__brelse+0x18/0x50
ext4_ext_drop_refs+0x3c/0x5c
ext4_ext_map_blocks+0x418/0x1b34
ext4_da_get_block_prep+0x200/0x4fc
__block_write_begin_int+0x160/0x630
__block_write_begin+0x3c/0x48fs stack.
ext4_da_write_begin+0x17c/0x574block layer issue (from ritesh)
generic_perform_write+0xc8/0x1d4uid issue
__generic_file_write_iter+0x15c/0x1a8
ext4_file_write_iter+0x108/0x354
new_sync_write+0xd8/0x124
vfs_write+0x15c/0x1d0
SyS_pwrite64+0xb0/0xc8
__sys_trace_return+0x0/0x4
reply other threads:[~2017-09-11 5:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c5d90b6ba6826fb0d6ab245befdfc405@codeaurora.org \
--to=ankijain@codeaurora.org \
--cc=linux-ext4@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.