Actually there is one waiting in state flush_work, one in
call_rwsem_down_read_failed and 12 in call_rwsem_down_write_failed.

The "flush_work" task call trace

 genesplicer     D    0 53332  52566 0x00000000
 Call Trace:
  __schedule+0x291/0x8a0
  ? __switch_to_asm+0x40/0x70
  ? get_work_pool+0x40/0x40
  schedule+0x2c/0x80
  schedule_timeout+0x1cf/0x350
  ? sched_clock+0x9/0x10
  ? sched_clock+0x9/0x10
  ? sched_clock_cpu+0x11/0xb0
  ? get_work_pool+0x40/0x40
  wait_for_completion+0xba/0x140
  ? wake_up_q+0x80/0x80
  flush_work+0x126/0x1e0
  ? worker_detach_from_pool+0xa0/0xa0
  __cancel_work_timer+0x131/0x1b0
  cancel_work_sync+0x10/0x20
  cifsFileInfo_put+0x1ab/0x400 [cifs]
  cifs_close+0x1e/0x40 [cifs]
  ? cifs_close+0x1e/0x40 [cifs]
  __fput+0xea/0x220
  ____fput+0xe/0x10
  task_work_run+0x9d/0xc0
  exit_to_usermode_loop+0xc0/0xd0
  do_syscall_64+0x115/0x130
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
 RIP: 0033:0x14f9e4ecf947
 RSP: 002b:00007ffe591c9898 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
 RAX: 0000000000000000 RBX: 000056367a99e260 RCX: 000014f9e4ecf947
 RDX: 000014f9e51a6760 RSI: 0000000000000001 RDI: 000000000000000b
 RBP: 000014f9e51a72a0 R08: 000014f9e53c14c0 R09: 0000000000000000
 R10: 000014f9e4f5dcc0 R11: 0000000000000206 R12: 0000000000000000
 R13: 00007ffe592be0a0 R14: 0000000000000000 R15: 0000000000000000

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1824981

Title:
  cifs set_oplock buffer overflow in strcat

Status in linux package in Ubuntu:
  Confirmed

Bug description:
  Ubuntu 18.04.2 LTS
  Linux SRV013 4.15.0-47-generic #50-Ubuntu SMP Wed Mar 13 10:44:52 UTC 2019 
x86_64 x86_64 x86_64 GNU/Linux

  DELL R740, 2 CPU (40 Cores, 80 Threads), 384 GiB RAM

  top - 12:39:53 up  3:41,  4 users,  load average: 66.19, 64.06, 76.90
  Tasks: 1076 total,   1 running, 675 sleeping,  12 stopped,   1 zombie
  %Cpu(s): 28.2 us,  0.3 sy,  0.0 ni, 71.5 id,  0.0 wa,  0.0 hi,  0.1 si,  0.0 
st
  KiB Mem : 39483801+total, 24077185+free, 57428284 used, 96637872 buff/cache
  KiB Swap:   999420 total,   999420 free,        0 used. 33477683+avail Mem


  We've seen the following bug many times since we introduced new
  machines running Ubuntu 18. Wasn't an issue older machines running
  Ubuntu 16. Three different machines are affected, so it's rather not a
  hardware issue.

  
  | detected buffer overflow in strcat
  | ------------[ cut here ]------------
  | kernel BUG at /build/linux-6ZmFRN/linux-4.15.0/lib/string.c:1052!
  | invalid opcode: 0000 [#1] SMP PTI
  | Modules linked in: [...]
  | Hardware name: Dell Inc. PowerEdge R740/0923K0, BIOS 1.6.11 11/20/2018
  | RIP: 0010:fortify_panic+0x13/0x22
  |  [...]
  | Call Trace:
  |  smb21_set_oplock_level+0x147/0x1a0 [cifs]
  |  smb3_set_oplock_level+0x22/0x90 [cifs]
  |  smb2_set_fid+0x76/0xb0 [cifs]
  |  cifs_new_fileinfo+0x259/0x390 [cifs]
  |  ? smb2_get_lease_key+0x40/0x40 [cifs]
  |  ? cifs_new_fileinfo+0x259/0x390 [cifs]
  |  cifs_open+0x3db/0x8d0 [cifs]
  |  [...]

  (Full dmesg output attached)

  After hitting this bug there are many cifs related dmesg entries,
  processes lock up and eventually the systems freezes.

  
  The share is mounted using:
  //server/share  /mnt/server/ cifs 
defaults,auto,iocharset=utf8,noperm,file_mode=0777,dir_mode=0777,credentials=/root/passwords/share,domain=myDomain,uid=myUser,gid=10513,mfsymlinks

  Currently we're testing the cifs mount options "cache=none" as the bug
  seems to be oplock related.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1824981/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to     : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to