Yes - good job. Merged into cifs-2.6.git for-next
On Thu, Jun 14, 2018 at 3:48 PM, ronnie sahlberg
<ronniesahlberg@xxxxxxxxx> wrote:
> Reviewed-by: Ronnie Sahlberg <lsahlber@xxxxxxxxxx>
>
> Awesome find Paolo!
>
> On Fri, Jun 15, 2018 at 6:34 AM, Paulo Alcantara <paulo@xxxxxxxx> wrote:
>> When traceSMB is enabled through 'echo 1 > /proc/fs/cifs/traceSMB', after a
>> mount, the following oops is triggered:
>>
>> [ 27.137943] BUG: unable to handle kernel paging request at
>> ffff8800f80c268b
>> [ 27.143396] PGD 2c6b067 P4D 2c6b067 PUD 0
>> [ 27.145386] Oops: 0000 [#1] SMP PTI
>> [ 27.146186] CPU: 2 PID: 2655 Comm: mount.cifs Not tainted 4.17.0+ #39
>> [ 27.147174] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
>> 1.0.0-prebuilt.qemu-project.org 04/01/2014
>> [ 27.148969] RIP: 0010:hex_dump_to_buffer+0x413/0x4b0
>> [ 27.149738] Code: 48 8b 44 24 08 31 db 45 31 d2 48 89 6c 24 18 44 89
>> 6c 24 24 48 c7 c1 78 b5 23 82 4c 89 64 24 10 44 89 d5 41 89 dc 4c 8d 58
>> 02 <44> 0f b7 00 4d 89 dd eb 1f 83 c5 01 41 01 c4 41 39 ef 0f 84 48 fe
>> [ 27.152396] RSP: 0018:ffffc9000058f8c0 EFLAGS: 00010246
>> [ 27.153129] RAX: ffff8800f80c268b RBX: 0000000000000000 RCX:
>> ffffffff8223b578
>> [ 27.153867] RDX: 0000000000000000 RSI: ffffffff81a55496 RDI:
>> 0000000000000008
>> [ 27.154612] RBP: 0000000000000000 R08: 0000000000000020 R09:
>> 0000000000000083
>> [ 27.155355] R10: 0000000000000000 R11: ffff8800f80c268d R12:
>> 0000000000000000
>> [ 27.156101] R13: 0000000000000002 R14: ffffc9000058f94d R15:
>> 0000000000000008
>> [ 27.156838] FS: 00007f1693a6b740(0000) GS:ffff88007fd00000(0000)
>> knlGS:0000000000000000
>> [ 27.158354] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 27.159093] CR2: ffff8800f80c268b CR3: 00000000798fa001 CR4:
>> 0000000000360ee0
>> [ 27.159892] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
>> 0000000000000000
>> [ 27.160661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
>> 0000000000000400
>> [ 27.161464] Call Trace:
>> [ 27.162123] print_hex_dump+0xd3/0x160
>> [ 27.162814] journal-offline (2658) used greatest stack depth: 13144
>> bytes left
>> [ 27.162824] ? __release_sock+0x60/0xd0
>> [ 27.165344] ? tcp_sendmsg+0x31/0x40
>> [ 27.166177] dump_smb+0x39/0x40
>> [ 27.166972] ? vsnprintf+0x236/0x490
>> [ 27.167807] __smb_send_rqst.constprop.12+0x103/0x430
>> [ 27.168554] ? apic_timer_interrupt+0xa/0x20
>> [ 27.169306] smb_send_rqst+0x48/0xc0
>> [ 27.169984] cifs_send_recv+0xda/0x420
>> [ 27.170639] SMB2_negotiate+0x23d/0xfa0
>> [ 27.171301] ? vsnprintf+0x236/0x490
>> [ 27.171961] ? smb2_negotiate+0x19/0x30
>> [ 27.172586] smb2_negotiate+0x19/0x30
>> [ 27.173257] cifs_negotiate_protocol+0x70/0xd0
>> [ 27.173935] ? kstrdup+0x43/0x60
>> [ 27.174551] cifs_get_smb_ses+0x295/0xbe0
>> [ 27.175260] ? lock_timer_base+0x67/0x80
>> [ 27.175936] ? __internal_add_timer+0x1a/0x50
>> [ 27.176575] ? add_timer+0x10f/0x230
>> [ 27.177267] cifs_mount+0x101/0x1190
>> [ 27.177940] ? cifs_smb3_do_mount+0x144/0x5c0
>> [ 27.178575] cifs_smb3_do_mount+0x144/0x5c0
>> [ 27.179270] mount_fs+0x35/0x150
>> [ 27.179930] vfs_kern_mount.part.28+0x54/0xf0
>> [ 27.180567] do_mount+0x5ad/0xc40
>> [ 27.181234] ? kmem_cache_alloc_trace+0xed/0x1a0
>> [ 27.181916] ksys_mount+0x80/0xd0
>> [ 27.182535] __x64_sys_mount+0x21/0x30
>> [ 27.183220] do_syscall_64+0x4e/0x100
>> [ 27.183882] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> [ 27.184535] RIP: 0033:0x7f169339055a
>> [ 27.185192] Code: 48 8b 0d 41 d9 2b 00 f7 d8 64 89 01 48 83 c8 ff c3
>> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f
>> 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0e d9 2b 00 f7 d8 64 89 01 48
>> [ 27.187268] RSP: 002b:00007fff7b44eb58 EFLAGS: 00000202 ORIG_RAX:
>> 00000000000000a5
>> [ 27.188515] RAX: ffffffffffffffda RBX: 00007f1693a7e70e RCX:
>> 00007f169339055a
>> [ 27.189244] RDX: 000055b9f97f64e5 RSI: 000055b9f97f652c RDI:
>> 00007fff7b45074f
>> [ 27.189974] RBP: 000055b9fb8c9260 R08: 000055b9fb8ca8f0 R09:
>> 0000000000000000
>> [ 27.190721] R10: 0000000000000000 R11: 0000000000000202 R12:
>> 000055b9fb8ca8f0
>> [ 27.191429] R13: 0000000000000000 R14: 00007f1693a7c000 R15:
>> 00007f1693a7e91d
>> [ 27.192167] Modules linked in:
>> [ 27.192797] CR2: ffff8800f80c268b
>> [ 27.193435] ---[ end trace 67404c618badf323 ]---
>>
>> The problem was that dump_smb() had been called with an invalid pointer,
>> that is, in __smb_send_rqst(), iov[1] doesn't exist (n_vec == 1).
>>
>> This patch fixes it by relying on the n_vec value to dump out the smb
>> packets.
>>
>> Signed-off-by: Paulo Alcantara <palcantara@xxxxxxx>
>> ---
>> fs/cifs/transport.c | 10 +++++-----
>> 1 file changed, 5 insertions(+), 5 deletions(-)
>>
>> diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
>> index 13c244dfb3c1..a3ea42a4cb98 100644
>> --- a/fs/cifs/transport.c
>> +++ b/fs/cifs/transport.c
>> @@ -281,17 +281,17 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
>> send_length += 4;
>> }
>>
>> + cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
>> +
>> for (j = 0; j < num_rqst; j++) {
>> iov = rqst[j].rq_iov;
>> n_vec = rqst[j].rq_nvec;
>>
>> - cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
>> - dump_smb(iov[0].iov_base, iov[0].iov_len);
>> - dump_smb(iov[1].iov_base, iov[1].iov_len);
>> -
>> size = 0;
>> - for (i = 0; i < n_vec; i++)
>> + for (i = 0; i < n_vec; i++) {
>> + dump_smb(iov[i].iov_base, iov[i].iov_len);
>> size += iov[i].iov_len;
>> + }
>>
>> iov_iter_kvec(&smb_msg.msg_iter, WRITE | ITER_KVEC,
>> iov, n_vec, size);
>> --
>> 2.17.1
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Thanks,
Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
