From: Peter Hurley <peter@hurleysoftware.com>
To: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org, Dave Jones <davej@redhat.com>,
Peter Hurley <peter@hurleysoftware.com>
Subject: [PATCH 00/10] ipc MSG_COPY fixes
Date: Mon, 25 Feb 2013 21:21:37 -0500 [thread overview]
Message-ID: <1361845307-12737-1-git-send-email-peter@hurleysoftware.com> (raw)
Over the weekend testing with trinity on KVM, I hit a similar oops
(pasted below) to what others have already reported here
http://lkml.indiana.edu/hypermail/linux/kernel/1302.2/01465.html
While trying to uncover the underlying cause of the list corruption,
I uncovered two other bugs which are addressed in
ipc: Fix potential oops when src msg > 4k w/ MSG_COPY
ipc: Don't allocate a copy larger than max
The other cleanup was incidental to trying to uncover the oops (so far
unsuccessfully).
Can the alloc_msg() be further simplified to allocate one block with
vmalloc() and link the msg segments in-place?
[ 86.026309] BUG: unable to handle kernel paging request at 0000000000058134
[ 86.035004] IP: [<ffffffff813087d0>] testmsg.isra.5+0x30/0x60
[ 86.035004] PGD 5ff2d067 PUD 5ee34067 PMD 0
[ 86.035004] Oops: 0000 [#1] PREEMPT SMP
[ 86.035004] Modules linked in: can_bcm bridge stp dlci af_rxrpc .......
[ 86.035004] CPU 5
[ 86.035004] Pid: 1736, comm: trinity-child37 Not tainted 3.9.0-next-20130220+ldsem-xeon+lockdep #20130220+ldsem Bochs Bochs
[ 86.035004] RIP: 0010:[<ffffffff813087d0>] [<ffffffff813087d0>] testmsg.isra.5+0x30/0x60
[ 86.035004] RSP: 0018:ffff88005ee2fe78 EFLAGS: 00010246
[ 86.035004] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000001
[ 86.035004] RDX: 0000000000000004 RSI: 8000000000000000 RDI: 0000000000058134
[ 86.035004] RBP: ffff88005ee2fe78 R08: 0000000b0ff40000 R09: 0000000000000000
[ 86.035004] R10: 0000000000000001 R11: 0000000000000000 R12: 8000000000000000
[ 86.035004] R13: ffff880061275c20 R14: 0000000000058124 R15: ffff880061275b70
[ 86.035004] FS: 00007f9b37442700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
[ 86.035004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.035004] CR2: 0000000000058134 CR3: 000000005ff2c000 CR4: 00000000000007e0
[ 86.035004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 86.035004] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 86.035004] Process trinity-child37 (pid: 1736, threadinfo ffff88005ee2e000, task ffff88005edaa440)
[ 86.035004] Stack:
[ 86.035004] ffff88005ee2ff68 ffffffff81309c06 00000000001d5b00 ffff88005edaa440
[ 86.035004] ffff88005edaa440 ffff88005edaa440 0000000000000000 ffffffff813085e0
[ 86.035004] 0000000000000000 ffff88005ff7e458 0000000000000000 00000000006fe000
[ 86.035004] Call Trace:
[ 86.035004] [<ffffffff81309c06>] do_msgrcv+0x1d6/0x6a0
[ 86.035004] [<ffffffff813085e0>] ? load_msg+0x180/0x180
[ 86.035004] [<ffffffff810d473d>] ? trace_hardirqs_on_caller+0x10d/0x1a0
[ 86.035004] [<ffffffff813b52fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 86.035004] [<ffffffff8130a0e5>] sys_msgrcv+0x15/0x20
[ 86.035004] [<ffffffff817aebd9>] system_call_fastpath+0x16/0x1b
[ 86.035004] Code: 55 83 fa 02 48 89 e5 74 32 7e 10 83 fa 03 74 3b 83 fa 04 74 16 31 c0 5d c3 66 90 83 fa 01 b8 01 00 00 00 74 f2 31 c0 eb ee 66 90 <48> 39 37 b8 01 00 00 00 7e e2 31 c0 eb de 66 90 48 3b 37 75 d5
[ 86.035004] RIP [<ffffffff813087d0>] testmsg.isra.5+0x30/0x60
[ 86.035004] RSP <ffff88005ee2fe78>
[ 86.035004] CR2: 0000000000058134
[ 86.183799] ---[ end trace f8a403aaa782a5b4 ]---
Peter Hurley (10):
ipc: Fix potential oops when src msg > 4k w/ MSG_COPY
ipc: Clamp with min()
ipc: Separate msg allocation from userspace copy
ipc: Tighten msg copy loops
ipc: Set EFAULT as default error in load_msg()
ipc: Don't allocate a copy larger than max
ipc: Remove msg handling from queue scan
ipc: Implement MSG_COPY as a new receive mode
ipc: Simplify msg list search
ipc: Refactor msg list search into separate function
ipc/msg.c | 84 +++++++++++++++++++++-----------------------
ipc/msgutil.c | 109 +++++++++++++++++++++++++++-------------------------------
2 files changed, 90 insertions(+), 103 deletions(-)
--
1.8.1.2
next reply other threads:[~2013-02-26 2:22 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-26 2:21 Peter Hurley [this message]
2013-02-26 2:21 ` [PATCH 01/10] ipc: Fix potential oops when src msg > 4k w/ MSG_COPY Peter Hurley
2013-02-26 2:21 ` [PATCH 02/10] ipc: Clamp with min() Peter Hurley
2013-02-26 2:21 ` [PATCH 03/10] ipc: Separate msg allocation from userspace copy Peter Hurley
2013-02-26 2:21 ` [PATCH 04/10] ipc: Tighten msg copy loops Peter Hurley
2013-02-26 2:21 ` [PATCH 05/10] ipc: Set EFAULT as default error in load_msg() Peter Hurley
2013-02-26 2:21 ` [PATCH 06/10] ipc: Don't allocate a copy larger than max Peter Hurley
2013-02-26 2:21 ` [PATCH 07/10] ipc: Remove msg handling from queue scan Peter Hurley
2013-02-26 2:21 ` [PATCH 08/10] ipc: Implement MSG_COPY as a new receive mode Peter Hurley
2013-02-26 2:21 ` [PATCH 09/10] ipc: Simplify msg list search Peter Hurley
2013-02-26 2:48 ` [PATCH v2 " Peter Hurley
2013-02-26 2:21 ` [PATCH 10/10] ipc: Refactor msg list search into separate function Peter Hurley
2013-02-26 2:55 ` [PATCH v2 " Peter Hurley
2013-02-26 7:53 ` [PATCH 00/10] ipc MSG_COPY fixes Stanislav Kinsbursky
2013-02-26 12:00 ` Peter Hurley
2013-03-01 4:12 ` Stanislav Kinsbursky
2013-02-28 23:46 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1361845307-12737-1-git-send-email-peter@hurleysoftware.com \
--to=peter@hurleysoftware.com \
--cc=akpm@linux-foundation.org \
--cc=davej@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=skinsbursky@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox