[linux-lvm] kernel-Oops in 2.4.17 with LVM-1.0.2

[Heinz J . Mauelshagen]

Urs,

lvm_map() calls buffer_IO_error() unconditionally in the error case.

Because function lvm_user_bmap(), which is called for the LV_BMAP ioctl,
sets up a temporary buffer_head structure, but just fills in the necessary
fields, buffer_IO_error() causes the NULL pointer derefenrence by trying
to call bh->b_end_io.

The following patch fixes that for lvm in 2.4.17 by
calling buffer_IO_error conditionally in lvm_map().

Regards,
Heinz    -- The LVM Guy --


diff -u linux-2.4.17.orig/drivers/md/lvm.c linux-2.4.17/drivers/md/
--- linux-2.4.17.orig/drivers/md/lvm.c  Mon Nov 19 18:56:04 2001
+++ linux-2.4.17/drivers/md/lvm.c       Wed Feb 20 15:21:42 2002
@@ -1049,6 +1049,7 @@
        bh.b_dev = bh.b_rdev = inode->i_rdev;
        bh.b_size = lvm_get_blksize(bh.b_dev);
        bh.b_rsector = block * (bh.b_size >> 9);
+        bh.b_end_io = NULL;
        if ((err=lvm_map(&bh, READ)) < 0)  {
                printk("lvm map failed: %d\n", err);
                return -EINVAL;
@@ -1254,7 +1255,7 @@
        return 1;

  bad:
-       buffer_IO_error(bh);
+       if (bh->b_end_io) buffer_IO_error(bh);
        up_read(&lv->lv_lock);
        return -1;
 } /* lvm_map() */


On Wed, Feb 20, 2002 at 11:16:06AM +0100, Urs Thuermann wrote:
> When using the LV_BMAP ioctl with an out-of-range block number, the
> kernel oopes in drviers/md/lvm.c:lvm_map().
> 
> The check in lvm_map() for out-of-range sector number works correctly,
> and the corresponding message is written to the kernel logs.
> 
> 	if (rsector_org + size > lv->lv_size) {
> 		printk(KERN_ALERT
> 		       "%s - lvm_map access beyond end of device; *rsector: "
>                        "%lu or size: %lu wrong for minor: %2d\n",
>                        lvm_name, rsector_org, size, minor);
> 		goto bad;
> 	}
> 
> After the "goto bad;" the Oops seems to be buffer_IO_error(bh).
> 
>  bad:
> 	buffer_IO_error(bh);
> 	up_read(&lv->lv_lock);
> 	return -1;
> 
> When using the LV_BMAP ioctl, lvm_map is called from lvm_user_bmap(),
> to which the system call does not return because of the oops.
> 
> 	if ((err=lvm_map(&bh, READ)) < 0)  {
> 		printk("lvm map failed: %d\n", err);
> 		return -EINVAL;
> 	}
> 
> The "lvm map failed..." error message is not logged.
> 
> 
> Here is the oops from the kernel.  It was produced by ioctl(LV_BMAP)
> on a LV of 128MB (262144) sectors, with lbm.lv_block = 131072.
> 
>     isnogud kernel: lvm - lvm_map access beyond end of device; *rsector: 262144 or size: 2 wrong for minor:  0
>     isnogud kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000000
>     isnogud kernel:  printing eip:
>     isnogud kernel: 00000000
>     isnogud kernel: *pde = 00000000
>     isnogud kernel: Oops: 0000
>     isnogud kernel: CPU:    0
>     isnogud kernel: EIP:    0010:[<00000000>]    Not tainted
>     isnogud kernel: EFLAGS: 00010246
>     isnogud kernel: eax: 00000000   ebx: c939df00   ecx: c939c000   edx: c939df00
>     isnogud kernel: esi: 00000000   edi: c939df60   ebp: c939df00   esp: c939de9c
>     isnogud kernel: ds: 0018   es: 0018   ss: 0018
>     isnogud kernel: Process lvm-map (pid: 18809, stackpage=c939d000)
>     isnogud kernel: Stack: d0836640 c939df00 00000000 bffffad4 00040000 c939df60 c939df00 cf9ae2c0 
>     isnogud kernel:        ca4c3820 cf9f2400 cf949000 400f0000 00000000 400f0550 cc6baca0 00000000 
>     isnogud kernel:        c903a960 d08360ab c939df00 00000000 00003a00 bffffad4 00003a00 c3c94060 
>     isnogud kernel: Call Trace: [8139too:__insmod_8139too_O/lib/modules/2.4.17-ut/kernel/drivers/net+-780736/96] [8139too:__insmod_8139too_O/lib/modules/2.4.17-ut/kernel/drivers/net+-782165/96] [8139too:__insmod_8139too_O/lib/modules/2.4.17-ut/kernel/drivers/net+-782740/96] [blkdev_ioctl+40/52] [sys_ioctl+363/388] 
>     isnogud kernel:    [system_call+51/56] 
>     isnogud kernel: 
>     isnogud kernel: Code:  Bad EIP value.
> 
> 
> urs
> 
> _______________________________________________
> linux-lvm mailing list
> linux-lvm at sistina.com
> http://lists.sistina.com/mailman/listinfo/linux-lvm
> read the LVM HOW-TO at http://www.sistina.com/lvm/Pages/howto.html

*** Software bugs are stupid.
    Nevertheless it needs not so stupid people to solve them ***

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Heinz Mauelshagen                                 Sistina Software Inc.
Senior Consultant/Developer                       Am Sonnenhang 11
                                                  56242 Marienrachdorf
                                                  Germany
Mauelshagen at Sistina.com                           +49 2626 141200
                                                       FAX 924446
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-