[Vserver] sendfile crash? (2.6.13.4 with vserver 2.1.0-rc4)

From: Grzegorz Nosek <grzegorz.nosek_at_gmail.com>
Date: Thu 03 Nov 2005 - 16:38:43 GMT
Message-ID: <121a28810511030838s118be14fv@mail.gmail.com>

Hello all

I needed to apply the patch below in order to keep the kernel from
oopsing (in some older revisions) or freezing solid (in the newest,
listed in the subject.

This is the bug that I came across earlier and made a fool out of
myself at the lkml :) Apparently the code around this place has been
modified but the offending check is still there. The code is checking
*ppos and max, which both have bogus values and this exact check (with
proper values) is made in vfs_sendfile a few lines earlier.

Why it freezes the box - I have no idea. I have also received some
reports about weird vserver behaviour (more crashes) but I'll gather
more info before I post.

Best regards,
Grzegorz Nosek

Oops (from netconsole - enabled it at last) follows:

Nov 3 17:18:40 40 [ 799.084295] Unable to handle kernel NULL pointer
dereference
Nov 3 17:18:40 40 at virtual address 00000004
Nov 3 17:18:40 40 [ 799.084365] printing eip:
Nov 3 17:18:40 40 [ 799.084394] a0174aa3
Nov 3 17:18:40 40 [ 799.084421] *pde = 00000000
Nov 3 17:18:40 40 [ 799.084451] Oops: 0000 [#1]
Nov 3 17:18:40 40 [ 799.084478] SMP
Nov 3 17:18:40 40
Nov 3 17:18:40 40 [ 799.084516] Modules linked in:
Nov 3 17:18:40 40 netconsole
Nov 3 17:18:40 40 ipt_owner
Nov 3 17:18:40 40 ipt_state
Nov 3 17:18:40 40 iptable_filter
Nov 3 17:18:40 40 e100
Nov 3 17:18:40 40 ip_conntrack_ftp
Nov 3 17:18:40 40 ip_conntrack
Nov 3 17:18:40 40
Nov 3 17:18:40 40 [ 799.084668] CPU: 1
Nov 3 17:18:40 40 [ 799.084670] EIP: 0060:[<a0174aa3>] Not tainted VLI
Nov 3 17:18:40 40 [ 799.084672] EFLAGS: 00010246 (2.6.13.4p4smp.12)
Nov 3 17:18:40 40 [ 799.084762] EIP is at do_sendfile+0xf3/0x140
Nov 3 17:18:40 40 [ 799.084792] eax: a5cbe550 ebx: a5cbe550 ecx:
00000000 edx: a5cbe550
Nov 3 17:18:40 40 [ 799.084829] esi: a378aacc edi: a378a04c ebp:
ae799f80 esp: ae799f3c
Nov 3 17:18:40 40 [ 799.084863] ds: 007b es: 007b ss: 0068
Nov 3 17:18:40 40 [ 799.084898] Process vsftpd (pid: 16732,
threadinfo=ae798000 task=a5cbe550)

--- linux-2.6/fs/read_write.c~ 2005-10-28 23:59:02.000000000 +0200
+++ linux-2.6/fs/read_write.c 2005-11-03 17:28:50.000000000 +0100
@@ -719,9 +719,6 @@
        current->syscr++;
        current->syscw++;

- if (*ppos > max)
- retval = -EOVERFLOW;
-
 fput_out:
        fput_light(out_file, fput_needed_out);
 fput_in:
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Thu Nov 3 16:39:06 2005

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 03 Nov 2005 - 16:39:14 GMT by hypermail 2.1.8