Re: null-ptr deref found in netfs code

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jan 23, 2025 at 10:05 PM David Howells <dhowells@xxxxxxxxxx> wrote:
>
> Shyam Prasad N <nspmangalore@xxxxxxxxx> wrote:
>
> > I tried this again with 6.13-rc1 and the null-ptr deref seems to be
> > slightly different (same function).
>
> Note that v6.13-rc1 doesn't include my patch.  You need to be on v6.13-rc7 for
> that.  There are a number of other patches that went in too that might affect
> what you're seeing.
>
> David
>

Hi David,

Tried this on v6.13. Same effect.
To reproduce (fairly consistently), I need to mount with an extra
mount option of rasize=8388608.

>> We're requesting reads of four folios, each consisting of 512 pages for a
>> total of 8MiB.
Based on your earlier analysis in this email thread, and based on my
reading of the code it sounds like there should be a max of 4 folios
in the folioq.

>> netfs: R=00005a08[a] s=2600000-29fffff ctl=200000/400000/400000 sl=5
But based on the OOPS that I attached in my last email, slot number is
5, which explains why folio at that slot is NULL.

I don't understand the donation logic well enough to understand why
slot could have overflowed like this. Maybe you can?

-- 
Regards,
Shyam





[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux