The commit is pushed to "branch-rh9-5.14.0-427.77.1.vz9.86.x-ovz" and will
appear at g...@bitbucket.org:openvz/vzkernel.git
after rh9-5.14.0-427.77.1.vz9.86.2
------>
commit af1cfed3997121a95ce21d9ab4c637f2ec5f4978
Author: Alexey Kuznetsov <kuz...@virtuozzo.com>
Date: Wed Jul 30 02:09:38 2025 +0800
fs/fuse kio pcs: null pointer dereference in clnt_input()
One more day zero bug, this time very simple. How we did not step on it
for 7 years even once, no idea, but this is the fact.
BUG: kernel NULL pointer dereference, address: 0000000000000020
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 21 PID: 57506 Comm: kworker/21:1 ve: / Kdump: loaded Tainted: G
O KX ------- --- 5.14.0-427.44.1.vz9.80.39 #1 80.39
Workqueue: pcs_cluster rpc_queue_work [fuse_kio_pcs]
RIP: 0010:_raw_spin_unlock+0x5/0x30
RSP: 0018:ff8343e968c4fd10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ff405a70ed89fab8 RCX: 0000000000000000
RDX: ff405a70809b8000 RSI: 0000000000000415 RDI: 0000000000000020
RBP: ff405a725aa80b00 R08: 0000000000000043 R09: 0000000000ffff0a
R10: 0000000000000003 R11: 0000000000000000 R12: ff405a6b8949b800
R13: 0000000000000010 R14: ff405a725aa80b00 R15: ff405a725aa80b00
FS: 0000000000000000(0000) GS:ff405a8a7fd40000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000020 CR3: 000000025be10002 CR4: 0000000000771ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
clnt_input+0x7c/0xb0 [fuse_kio_pcs]
rpc_work_input+0x53/0x210 [fuse_kio_pcs]
pcs_sockio_recv+0x2f7/0x6b0 [fuse_kio_pcs]
pcs_sockio_xmit+0x2c/0x40 [fuse_kio_pcs]
rpc_queue_work+0x110/0x3d0 [fuse_kio_pcs]
process_one_work+0x1e2/0x3b0
worker_thread+0x50/0x3a0
kthread+0xdd/0x100
ret_from_fork+0x29/0x50
</TASK>
CR2: 0000000000000020
Fixes: #VSTOR-112356
https://virtuozzo.atlassian.net/browse/VSTOR-112356
Signed-off-by: Alexey Kuznetsov <kuz...@virtuozzo.com>
Reviewed-by: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Feature: vStorage
---
fs/fuse/kio/pcs/pcs_cs.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/fuse/kio/pcs/pcs_cs.c b/fs/fuse/kio/pcs/pcs_cs.c
index 10d6c860c3f84..df80d8a87796f 100644
--- a/fs/fuse/kio/pcs/pcs_cs.c
+++ b/fs/fuse/kio/pcs/pcs_cs.c
@@ -839,13 +839,11 @@ void cs_handle_congestion(struct pcs_cs *cs, struct
pcs_rpc_hdr *h)
FUSE_KTRACE(cc_from_csset(cs->css)->fc, "Received congestion
notification from CS" NODE_FMT, NODE_ARGS(h->xid.origin));
- if (cs->id.val == h->xid.origin.val) {
- who = cs;
- spin_lock(&who->lock);
- } else
- who = lookup_and_lock_cs(cs->css, h->xid.origin.val);
+ who = lookup_and_lock_cs(cs->css, h->xid.origin.val);
+ if (unlikely(!who))
+ return;
- if (who && !who->cwr_state) {
+ if (!who->cwr_state) {
/* Unless node is already reducing congestion window, shrink it
* to half of min(in_flight, cwnd) and enter congestion
reduction state,
* where we ignore further congestion notifications until
window is reduced
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
