From patchwork Fri Oct 13 14:47:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Oleg Nesterov X-Patchwork-Id: 10004931 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0512B602B3 for ; Fri, 13 Oct 2017 14:48:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EA9C92905F for ; Fri, 13 Oct 2017 14:48:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DF6FE29094; Fri, 13 Oct 2017 14:48:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 960C62905F for ; Fri, 13 Oct 2017 14:48:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757889AbdJMOrw (ORCPT ); Fri, 13 Oct 2017 10:47:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33832 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753394AbdJMOrv (ORCPT ); Fri, 13 Oct 2017 10:47:51 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 33CBD2AD63; Fri, 13 Oct 2017 14:47:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 33CBD2AD63 Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=oleg@redhat.com Received: from dhcp-27-174.brq.redhat.com (dhcp-1-118.brq.redhat.com [10.34.1.118]) by smtp.corp.redhat.com (Postfix) with SMTP id 1018C68736; Fri, 13 Oct 2017 14:47:46 +0000 (UTC) Received: by dhcp-27-174.brq.redhat.com (nbSMTP-1.00) for uid 1000 oleg@redhat.com; Fri, 13 Oct 2017 16:47:50 +0200 (CEST) Date: Fri, 13 Oct 2017 16:47:45 +0200 From: Oleg Nesterov To: Stanislaw Gruszka Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexander Viro , Eryu Guan Subject: Re: Crash in bm_evict_inode() during shutdown. Message-ID: <20171013144745.GA23154@redhat.com> References: <20171013134436.GB3359@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20171013134436.GB3359@redhat.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 13 Oct 2017 14:47:51 +0000 (UTC) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 10/13, Stanislaw Gruszka wrote: > > On 4.14-rc4 updated today, I have OOPS on bm_evict_inode(). It happens > every time during shutdown of the system. > > Seems e = inode->i_private is NULL and e->flags crashes. Yes, sorry, my fault. Fixed by the patch from Eryu, already in -mm tree. Oleg. binfmt_misc: Node could be NULL when evicting inode inode->i_private is assigned by a Node pointer only after registering a new binary format, and it's possible to be NULL if inode was created by bm_fill_super() (or iput() was called by the error path in bm_register_write()), and this could result in NULL pointer dereference when evicting such an inode. e.g. mount binfmt_misc filesystem then umount it immediately: mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc umount /proc/sys/fs/binfmt_misc [ 9379.678259] BUG: unable to handle kernel NULL pointer dereference at 0000000000000013 [ 9379.985952] IP: bm_evict_inode+0x16/0x40 [binfmt_misc] ... [ 9380.964911] Call Trace: [ 9380.977633] evict+0xd3/0x1a0 [ 9380.994449] iput+0x17d/0x1d0 [ 9381.010306] dentry_unlink_inode+0xb9/0xf0 [ 9381.034046] __dentry_kill+0xc7/0x170 [ 9381.055145] shrink_dentry_list+0x122/0x280 [ 9381.078908] shrink_dcache_parent+0x39/0x90 [ 9381.103082] do_one_tree+0x12/0x40 [ 9381.122005] shrink_dcache_for_umount+0x2d/0x90 [ 9381.146517] generic_shutdown_super+0x1f/0x120 [ 9381.171644] kill_litter_super+0x29/0x40 [ 9381.193513] deactivate_locked_super+0x43/0x70 [ 9381.219177] deactivate_super+0x45/0x60 [ 9381.240130] cleanup_mnt+0x3f/0x70 [ 9381.259064] __cleanup_mnt+0x12/0x20 [ 9381.279802] task_work_run+0x86/0xa0 [ 9381.299612] exit_to_usermode_loop+0x6d/0x99 [ 9381.323872] syscall_return_slowpath+0xba/0xf0 [ 9381.350464] entry_SYSCALL_64_fastpath+0xa3/0xa Fix it by making sure Node (e) is not NULL. Cc: Oleg Nesterov Fixes: 83f918274e4b ("exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode()") Acked-by: Oleg Nesterov Signed-off-by: Eryu Guan --- v2: - update commit log as suggested by Oleg Hi Andrew, could you please help replace the v1 patch in -mm tree with this v2? The new commit log describes the problem more accurately. Thanks! fs/binfmt_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index 2a46762def31..a7c5a9861bef 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -596,7 +596,7 @@ static void bm_evict_inode(struct inode *inode) { Node *e = inode->i_private; - if (e->flags & MISC_FMT_OPEN_FILE) + if (e && e->flags & MISC_FMT_OPEN_FILE) filp_close(e->interp_file, NULL); clear_inode(inode);