This bug was nominated against a series that is no longer supported, ie
artful. The bug task representing the artful nomination is being closed
as Won't Fix.
This change has been made by an automated script, maintained by the
Ubuntu Kernel Team.
** Changed in: linux (Ubuntu Artful)
Status: Fix Committed => Won't Fix
--
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1729256
Title:
Invalid btree pointer causes the kernel NULL pointer dereference
Status in linux package in Ubuntu:
Incomplete
Status in linux source package in Xenial:
Fix Released
Status in linux source package in Zesty:
Fix Released
Status in linux source package in Artful:
Won't Fix
Bug description:
[Impact]
The frequent kernel errors can be seen inside the XFS based OSD
processes and it causes to crash and restart.
BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
IP: [<ffffffffc03705a0>] xfs_da3_node_read+0x30/0xb0 [xfs]
CPU: 8 PID: 2855031 Comm: tp_fstore_op Not tainted 4.4.0-78-generic #99-Ubuntu
Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 09/13/2016
task: ffff880620f38e00 ti: ffff880678228000 task.ti: ffff880678228000
RIP: 0010:[<ffffffffc03705a0>] [<ffffffffc03705a0>]
xfs_da3_node_read+0x30/0xb0 [xfs]
RSP: 0018:ffff88067822bd00 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88078abff3f0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88067822bcb0
RBP: ffff88067822bd20 R08: 0000000000000001 R09: fffffffffffffffe
R10: ffffea001e2aff80 R11: 0000000000000001 R12: ffff88067822bd50
R13: ffff8805a37f0000 R14: 0000000000000001 R15: 000000008d180e3e
FS: 00007f7573c01700(0000) GS:ffff88103fa00000(0000)knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000a0 CR3: 0000001686f3d000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffffffffc03cfb50 ffffffffc03b0ecc ffff88067822bde0 0000000000000001
ffff88067822bd98 ffffffffc038c8b3 0000000200000008 ffff88081cb06040
00000002d8723bf8 ffff880fc142ae80 0000000000000000 0000000000000000
Call Trace:
[<ffffffffc03b0ecc>] ? xfs_trans_roll+0x2c/0x50 [xfs]
[<ffffffffc038c8b3>] xfs_attr3_node_inactive+0x183/0x220 [xfs]
[<ffffffffc038c9fc>] xfs_attr3_root_inactive+0xac/0x100 [xfs]
[<ffffffffc038cb9c>] xfs_attr_inactive+0x14c/0x1a0 [xfs]
[<ffffffffc03a6da5>] xfs_inactive+0x85/0x120 [xfs]
[<ffffffffc03ac2f5>] xfs_fs_evict_inode+0xa5/0x100 [xfs]
[<ffffffff8122aaee>] evict+0xbe/0x190
[<ffffffff8122add1>] iput+0x1c1/0x240
[<ffffffff8121f859>] do_unlinkat+0x199/0x2d0
[<ffffffff812203f6>] SyS_unlink+0x16/0x20
[<ffffffff81840a32>] entry_SYSCALL_64_fastpath+0x16/0x71
[Fix]
commit e678a63e6c95f140befe6fcd81b49075ecb3c701
Author: Brian Foster <bfos...@redhat.com>
Date: Mon Oct 9 11:38:56 2017 -0700
xfs: reinit btree pointer on attr tree inactivation walk
xfs_attr3_root_inactive() walks the attr fork tree to invalidate the
associated blocks. xfs_attr3_node_inactive() recursively descends from
internal blocks to leaf blocks, caching block address values along the
way to revisit parent blocks, locate the next entry and descend down
that branch of the tree.
The code that attempts to reread the parent block is unsafe because it
assumes that the local xfs_da_node_entry pointer remains valid after
an xfs_trans_brelse() and re-read of the parent buffer. Under heavy
memory pressure, it is possible that the buffer has been reclaimed and
reallocated by the time the parent block is reread. This means that
'btree' can point to an invalid memory address, lead to a
random/garbage value for child_fsb and cause the subsequent read of
the attr fork to go off the rails and return a NULL buffer for an attr
fork offset that is most likely not allocated.
Note that this problem can be manufactured by setting
XFS_ATTR_BTREE_REF to 0 to prevent LRU caching of attr buffers,
creating a file with a multi-level attr fork and removing it to
trigger inactivation.
To address this problem, reinit the node/btree pointers to the parent
buffer after it has been re-read. This ensures btree points to a valid
record and allows the walk to proceed.
[Test]
The patch has been tested on the production system.
[Regression Risk]
Clean cherry-pick queued for stable, so we'll be picking it up anyway.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1729256/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help : https://help.launchpad.net/ListHelp
