Still present in 4.19.5
Oops: 0000 [#1] SMP PTI
CPU: 6 PID: 1523 Comm: snmpd Kdump: loaded Not tainted
4.19.5-1.el7.elrepo.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 09/21/2015
RIP: 0010:SMB2_query_info_free+0xc/0x20 [cifs]
Code: c7 c7 b8 bd 63 a0 31 c0 e8 5f 38 ae e0 44 8b 54 24 30 eb d8 66
2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 <48> 8b
38 e8 9c 15 fe ff 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffffc90002aafb80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffc90002aafd10 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffffc90002aafd38
RBP: ffffc90002aafb80 R08: 0000000000000000 R09: 0000000000005bf1
R10: 0000000000000007 R11: 0000000000005bf0 R12: ffff888412f2f800
R13: ffffc90002aafbf0 R14: ffff888428d6b800 R15: 0000000000000000
FS: 00007f6166975840(0000) GS:ffff88842fb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000412952006 CR4: 00000000001606e0
Call Trace:
smb2_queryfs+0x13a/0x310 [cifs]
? up+0x32/0x4c
? vprintk_emit+0xc3/0x260
? vprintk_default+0x29/0x50
? vprintk_func+0x44/0xe0
cifs_statfs+0xb2/0x2a0 [cifs]
statfs_by_dentry+0xa1/0x120
vfs_statfs+0x1b/0xc0
user_statfs+0x58/0xa0
__do_sys_statfs+0x27/0x60
__x64_sys_statfs+0x16/0x20
do_syscall_64+0x60/0x190
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f61641a6787
Code: 2d 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 48 8b 15 fd 66 2d
00 f7 d8 64 89 02 48 83 c8 ff c3 0f 1f 00 b8 89 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 8b 0d d9 66 2d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd380bc6f8 EFLAGS: 00000283 ORIG_RAX: 0000000000000089
RAX: ffffffffffffffda RBX: 000055ef7125bb80 RCX: 00007f61641a6787
RDX: 00007f6165e12720 RSI: 00007ffd380bc710 RDI: 000055ef7125bb90
RBP: 000055ef7125bb90 R08: 000000000000006f R09: 0000000000000072
R10: 000000000000010c R11: 0000000000000283 R12: 000055ef71259980
R13: 0000000000000005 R14: 000055ef7125bf91 R15: 00007f6164480580
Modules linked in: sha512_ssse3 sha512_generic cmac nls_utf8 cifs ccm
dns_resolver nfsv3 nfs_acl nfs lockd grace fscache binfmt_misc
ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6
xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute ip6table_nat
nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat
nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
libcrc32c iptable_mangle iptable_security iptable_raw ebtable_filter
ebtables ip6table_filter ip6_tables iptable_filter
vmw_vsock_vmci_transport vsock sb_edac crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel pcbc aesni_intel crypto_simd cryptd glue_helper
intel_rapl_perf vmw_balloon pcspkr joydev input_leds sg vmw_vmci
i2c_piix4 tcp_bbr sch_fq auth_rpcgss sunrpc ip_tables ext4 mbcache
jbd2
On Wed, Nov 28, 2018 at 4:15 PM Steve French <smfrench@xxxxxxxxx> wrote:
>
> So this does not occur in 4.18 and 4.20 but does in 4.19 - I thought
> Ronnie had identified it
> On Wed, Nov 28, 2018 at 7:59 AM Robin P. Blanchard
> <robin.blanchard@xxxxxxxxx> wrote:
> >
> > I receive a similar OOPS on 4.19.2 (have updated to 4.19.5 and will
> > continue to monitor):
> >
> > Oops: 0000 [#2] SMP PTI
> > CPU: 3 PID: 15929 Comm: python Kdump: loaded Tainted: G D
> > 4.19.2-1.el7.elrepo.x86_64 #1
> > Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
> > Reference Platform, BIOS 6.00 09/21/2015
> > RIP: 0010:SMB2_query_info_free+0xc/0x20 [cifs]
> > Code: c7 c7 b8 6d 63 a0 31 c0 e8 5f 88 ae e0 44 8b 54 24 30 eb d8 66
> > 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 <48> 8b
> > 38 e8 ac 15 fe ff 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
> > RSP: 0018:ffffc90001f43b80 EFLAGS: 00010246
> > RAX: 0000000000000000 RBX: ffffc90001f43d10 RCX: 0000000000000006
> > RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffffc90001f43d38
> > RBP: ffffc90001f43b80 R08: 0000000000000000 R09: 00000000003b5f65
> > R10: 0000000000000001 R11: 0000000000aaaaaa R12: ffff880424dd5800
> > R13: ffffc90001f43bf0 R14: ffff880169abdc00 R15: 0000000000000000
> > FS: 00007f56e1f36740(0000) GS:ffff88042fac0000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000000000000000 CR3: 0000000036402006 CR4: 00000000001606e0
> > Call Trace:
> > smb2_queryfs+0x13a/0x310 [cifs]
> > ? up+0x32/0x4c
> > ? vprintk_emit+0xc3/0x260
> > ? vprintk_default+0x29/0x50
> > ? vprintk_func+0x44/0xe0
> > cifs_statfs+0xb2/0x2a0 [cifs]
> > statfs_by_dentry+0xa1/0x120
> > vfs_statfs+0x1b/0xc0
> > user_statfs+0x58/0xa0
> > __do_sys_statfs+0x27/0x60
> > __x64_sys_statfs+0x16/0x20
> > do_syscall_64+0x60/0x190
> > entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > RIP: 0033:0x7f56e0d59787
> > Code: 2d 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 48 8b 15 fd 66 2d
> > 00 f7 d8 64 89 02 48 83 c8 ff c3 0f 1f 00 b8 89 00 00 00 0f 05 <48> 3d
> > 01 f0 ff ff 73 01 c3 48 8b 0d d9 66 2d 00 f7 d8 64 89 01 48
> > RSP: 002b:00007ffc18f00108 EFLAGS: 00000202 ORIG_RAX: 0000000000000089
> > RAX: ffffffffffffffda RBX: 00007f56da1423b4 RCX: 00007f56e0d59787
> > RDX: 00007f56e1d22068 RSI: 00007ffc18f00110 RDI: 00007f56da1423b4
> > RBP: 00007f56e1e000d0 R08: 00007f56da1423b4 R09: 00007ffc18f00020
> > R10: 0000000000000000 R11: 0000000000000202 R12: 00007f56e1ef4240
> > R13: 00007ffc18f00280 R14: 00007f56da13d410 R15: 00007f56e1ef55f0
> > Modules linked in: sha512_ssse3 sha512_generic cmac nls_utf8 cifs ccm
> > dns_resolver nfsv3 nfs_acl nfs lockd grace fscache binfmt_misc
> > ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6
> > xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute ip6table_nat
> > nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat
> > nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
> > libcrc32c iptable_mangle iptable_security iptable_raw ebtable_filter
> > ebtables ip6table_filter ip6_tables iptable_filter
> > vmw_vsock_vmci_transport vsock sb_edac crct10dif_pclmul crc32_pclmul
> > ghash_clmulni_intel pcbc aesni_intel crypto_simd cryptd glue_helper
> > intel_rapl_perf vmw_balloon joydev input_leds pcspkr vmw_vmci sg
> > i2c_piix4 auth_rpcgss sunrpc tcp_bbr sch_fq ip_tables ext4 mbcache
> > jbd2
> > sr_mod cdrom ata_generic pata_acpi sd_mod crc32c_intel vmwgfx
> > serio_raw drm_kms_helper syscopyarea sysfillrect vmxnet3 sysimgblt
> > fb_sys_fops ttm ata_piix drm vmw_pvscsi libata dm_mirror
> > dm_region_hash dm_log dm_mod
> > Dumping ftrace buffer:
> > (ftrace buffer empty)
> > CR2: 0000000000000000
> > ---[ end trace 796e5580f5f00736 ]---
> > RIP: 0010:SMB2_query_info_free+0xc/0x20 [cifs]
> > Code: c7 c7 b8 6d 63 a0 31 c0 e8 5f 88 ae e0 44 8b 54 24 30 eb d8 66
> > 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 <48> 8b
> > 38 e8 ac 15 fe ff 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
> > RSP: 0018:ffffc90002b13b80 EFLAGS: 00010246
> > RAX: 0000000000000000 RBX: ffffc90002b13d10 RCX: 0000000000000006
> > RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffffc90002b13d38
> > RBP: ffffc90002b13b80 R08: 0000000000000000 R09: 00000000000056a6
> > R10: 0000000000000007 R11: 00000000000056a5 R12: ffff880424dd5800
> > R13: ffffc90002b13bf0 R14: ffff880169abdc00 R15: 0000000000000000
> > FS: 00007f56e1f36740(0000) GS:ffff88042fac0000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000000000000000 CR3: 0000000036402006 CR4: 00000000001606e0
> > On Sat, Nov 24, 2018 at 3:02 AM Sasha Levin <sashal@xxxxxxxxxx> wrote:
> > >
> > > On Fri, Nov 23, 2018 at 05:21:09PM -0600, Steve French wrote:
> > > >---------- Forwarded message ---------
> > > >From: Sasha Levin <sashal@xxxxxxxxxx>
> > > >Date: Fri, Nov 23, 2018 at 1:43 PM
> > > >Subject: Re: NULL pointer dereference in smb2_queryfs with v4.19.2
> > > >To: Steve French <smfrench@xxxxxxxxx>
> > > >Cc: <stijn@xxxxxxxxxxxxx>, Stable <stable@xxxxxxxxxxxxxxx>, CIFS
> > > ><linux-cifs@xxxxxxxxxxxxxxx>, samba-technical
> > > ><samba-technical@xxxxxxxxxxxxxxx>
> > > >
> > > >
> > > >On Tue, Nov 20, 2018 at 02:16:15PM -0600, Steve French wrote:
> > > >>At first glance it looks like it is missing from the 4.19 stable tree
> > > >>On Tue, Nov 20, 2018 at 2:14 PM Steve French <smfrench@xxxxxxxxx> wrote:
> > > >>>
> > > >>> Do you know if you are running with this patch (which was marked for stable)
> > > >
> > > >
> > > >> This commit depends on ba8ca116854 ("cifs: create helpers for
> > > >>SMB2_set_info_init/free()") which is not marked for stable and is not
> > > >>trivial.
> > > >>
> > > >> If anyone wants to send a backport I'd be happy to queue this patch up.
> > > >
> > > >That should not be needed.
> > > >The dependency you mention - "create helpers for
> > > >SMB2_set_info_init/free..." is already in 4.19 and is the patch which
> > > >the stable patch requested ("allow calling SMB2_xxx_free...") fixes.
> > >
> > > Hm, it's not in 4.19 - it was merged during the 4.20 merge window.
> > >
> > > --
> > > Thanks,
> > > Sasha
>
>
>
> --
> Thanks,
>
> Steve
