From: Dave Jones <davej@redhat.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>
Subject: Re: pipe/page fault oddness.
Date: Tue, 30 Sep 2014 00:33:09 -0400 [thread overview]
Message-ID: <20140930043309.GA16196@redhat.com> (raw)
In-Reply-To: <CA+55aFwmo7ot=h7tpUYhSC49CHKBK2KfGaDJ_fwB0=VNqvTPBQ@mail.gmail.com>
On Mon, Sep 29, 2014 at 09:27:09PM -0700, Linus Torvalds wrote:
> On Mon, Sep 29, 2014 at 8:33 PM, Dave Jones <davej@redhat.com> wrote:
> >
> > Looking at the dump, there's only one running trinity child,
> > with all the others blocking on it.
> >
> > trinity-c49 R running task 12856 19464 7633 0x00000004
> > ffff8800a09bf960 0000000000000002 ffff8800a09bf9f8 ffff880219650000
> > 00000000001d4080 0000000000000000 ffff8800a09bffd8 00000000001d4080
> > ffff88023f755bc0 ffff880219650000 ffff8800a09bffd8 ffff88010b017e00
> > Call Trace:
> > [<ffffffff911c3c67>] handle_mm_fault+0x3a7/0xcd0
> > [<ffffffff91042c84>] __do_page_fault+0x1a4/0x600
> > [<ffffffff910430fe>] do_page_fault+0x1e/0x70
> > [<ffffffff918264b2>] page_fault+0x22/0x30
> > [<ffffffff911bd7e3>] ? copy_page_to_iter+0x3b3/0x500
> > [<ffffffff9120eddf>] pipe_read+0xdf/0x330
> >
> > Running the function tracer on that pid shows it spinning forever..
> > http://codemonkey.org.uk/junk/pipe-trace.txt
> >
> > Kernel bug (missing EFAULT check somewhere perhaps?), or is this a
> > case where the fuzzer asked the kernel to do something stupid, and it obliged ?
>
> Hmm. It looks like copy_page_to_iter_iovec() is broken and keeps not
> making any progress while just faulting.
>
> I don't see how that could happen, though. All the loops there are
> conditional on the user copies *not* failing (ie "!left"), and they
> seem to properly update "iov".
>
> Mind sending a disassembly of your "copy_page_to_iter" function, in
> particular around that whole "0x3b3/0x500" area which is where the
> page fault seems to happen?
Whole file is at http://codemonkey.org.uk/junk/iov_iter.txt
gcc is 4.8.3 btw
Dave
next prev parent reply other threads:[~2014-09-30 4:33 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-30 3:33 pipe/page fault oddness Dave Jones
2014-09-30 4:27 ` Linus Torvalds
2014-09-30 4:33 ` Dave Jones [this message]
[not found] ` <CA+55aFwxdOBKHwwp7Zq1k19mHCyHYmYqigCVt59AtB-P7Zva1w@mail.gmail.com>
2014-09-30 15:52 ` Linus Torvalds
2014-09-30 16:03 ` Rik van Riel
2014-09-30 16:07 ` Dave Jones
2014-09-30 16:26 ` Linus Torvalds
2014-09-30 16:05 ` Dave Jones
2014-09-30 16:10 ` Linus Torvalds
2014-09-30 16:22 ` Dave Jones
2014-09-30 16:40 ` Dave Jones
2014-09-30 16:46 ` Linus Torvalds
2014-09-30 18:20 ` Dave Jones
2014-09-30 18:58 ` Linus Torvalds
2014-10-01 8:19 ` Hugh Dickins
2014-10-01 16:01 ` Linus Torvalds
2014-10-01 16:18 ` Linus Torvalds
2014-10-01 17:29 ` Rik van Riel
2014-10-02 8:28 ` Peter Zijlstra
2014-10-01 20:20 ` Linus Torvalds
2014-10-01 21:09 ` Rik van Riel
2014-10-01 22:08 ` Sasha Levin
2014-10-01 22:28 ` Chuck Ebbert
2014-10-02 3:32 ` Sasha Levin
2014-10-02 8:03 ` Chuck Ebbert
2014-10-02 14:49 ` Sasha Levin
2014-10-01 22:42 ` Linus Torvalds
2014-10-02 14:25 ` Kirill A. Shutemov
2014-10-02 16:01 ` Linus Torvalds
2014-10-02 16:35 ` Kirill A. Shutemov
2014-10-02 15:04 ` Sasha Levin
2014-10-02 16:10 ` Linus Torvalds
2014-10-03 5:00 ` Sasha Levin
2014-10-03 15:43 ` Linus Torvalds
2014-10-03 15:58 ` Dave Jones
2014-10-03 16:02 ` Sasha Levin
2014-10-02 12:45 ` Mel Gorman
2014-10-06 19:18 ` Aneesh Kumar K.V
2014-10-07 12:45 ` Linus Torvalds
2014-10-08 10:37 ` Aneesh Kumar K.V
2014-10-02 8:47 ` Hugh Dickins
2014-10-02 15:57 ` Linus Torvalds
2014-09-30 4:35 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140930043309.GA16196@redhat.com \
--to=davej@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).