** Tags removed: verification-needed-xenial verification-needed-zesty ** Tags added: verification-done-xenial verification-done-zesty
-- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1729256 Title: Invalid btree pointer causes the kernel NULL pointer dereference Status in linux package in Ubuntu: Incomplete Status in linux source package in Xenial: Fix Committed Status in linux source package in Zesty: Fix Committed Status in linux source package in Artful: Fix Committed Bug description: [Impact] The frequent kernel errors can be seen inside the XFS based OSD processes and it causes to crash and restart. BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 IP: [<ffffffffc03705a0>] xfs_da3_node_read+0x30/0xb0 [xfs] CPU: 8 PID: 2855031 Comm: tp_fstore_op Not tainted 4.4.0-78-generic #99-Ubuntu Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 09/13/2016 task: ffff880620f38e00 ti: ffff880678228000 task.ti: ffff880678228000 RIP: 0010:[<ffffffffc03705a0>] [<ffffffffc03705a0>] xfs_da3_node_read+0x30/0xb0 [xfs] RSP: 0018:ffff88067822bd00 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88078abff3f0 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88067822bcb0 RBP: ffff88067822bd20 R08: 0000000000000001 R09: fffffffffffffffe R10: ffffea001e2aff80 R11: 0000000000000001 R12: ffff88067822bd50 R13: ffff8805a37f0000 R14: 0000000000000001 R15: 000000008d180e3e FS: 00007f7573c01700(0000) GS:ffff88103fa00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a0 CR3: 0000001686f3d000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffffc03cfb50 ffffffffc03b0ecc ffff88067822bde0 0000000000000001 ffff88067822bd98 ffffffffc038c8b3 0000000200000008 ffff88081cb06040 00000002d8723bf8 ffff880fc142ae80 0000000000000000 0000000000000000 Call Trace: [<ffffffffc03b0ecc>] ? xfs_trans_roll+0x2c/0x50 [xfs] [<ffffffffc038c8b3>] xfs_attr3_node_inactive+0x183/0x220 [xfs] [<ffffffffc038c9fc>] xfs_attr3_root_inactive+0xac/0x100 [xfs] [<ffffffffc038cb9c>] xfs_attr_inactive+0x14c/0x1a0 [xfs] [<ffffffffc03a6da5>] xfs_inactive+0x85/0x120 [xfs] [<ffffffffc03ac2f5>] xfs_fs_evict_inode+0xa5/0x100 [xfs] [<ffffffff8122aaee>] evict+0xbe/0x190 [<ffffffff8122add1>] iput+0x1c1/0x240 [<ffffffff8121f859>] do_unlinkat+0x199/0x2d0 [<ffffffff812203f6>] SyS_unlink+0x16/0x20 [<ffffffff81840a32>] entry_SYSCALL_64_fastpath+0x16/0x71 [Fix] commit e678a63e6c95f140befe6fcd81b49075ecb3c701 Author: Brian Foster <bfos...@redhat.com> Date: Mon Oct 9 11:38:56 2017 -0700 xfs: reinit btree pointer on attr tree inactivation walk xfs_attr3_root_inactive() walks the attr fork tree to invalidate the associated blocks. xfs_attr3_node_inactive() recursively descends from internal blocks to leaf blocks, caching block address values along the way to revisit parent blocks, locate the next entry and descend down that branch of the tree. The code that attempts to reread the parent block is unsafe because it assumes that the local xfs_da_node_entry pointer remains valid after an xfs_trans_brelse() and re-read of the parent buffer. Under heavy memory pressure, it is possible that the buffer has been reclaimed and reallocated by the time the parent block is reread. This means that 'btree' can point to an invalid memory address, lead to a random/garbage value for child_fsb and cause the subsequent read of the attr fork to go off the rails and return a NULL buffer for an attr fork offset that is most likely not allocated. Note that this problem can be manufactured by setting XFS_ATTR_BTREE_REF to 0 to prevent LRU caching of attr buffers, creating a file with a multi-level attr fork and removing it to trigger inactivation. To address this problem, reinit the node/btree pointers to the parent buffer after it has been re-read. This ensures btree points to a valid record and allows the walk to proceed. [Test] The patch has been tested on the production system. [Regression Risk] Clean cherry-pick queued for stable, so we'll be picking it up anyway. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1729256/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
