[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#796036: linux-image-3.16.0-4-amd64: concurrent msync triggers NULL pointer dereference



On 18/08/2015 20:05, Xavier Chantry wrote:
Package: src:linux
Version: 3.16.7-ckt11-1
Severity: important

Using Debian 3.16.7-ckt4-3 and a simple test case, we were able to reproduce a
kernel bug in msync system call.

The test case does the following:
1) create a 1MB file and mmap it
2) in a loop, select a 4k page in that file randomly, write with memset, then
run msync on that area in a thread

The problem was first seen in debian 3.12, and also reproduced with debian 3.16
and 4.1.0 kernels. Debian 3.2 was fine.
Vanilla kernels do not seem to be affected.

In fact the crash happens in vma_do_fput which comes with aufs4-mmap.patch


I confirm that the problem occurs on vanilla 4.1.6 after applying just that patch : ./linux/debian/patches/features/all/aufs4/aufs4-mmap.patch from svn://svn.debian.org/svn/kernel/dists/trunk

Same with the upstream patch at https://raw.githubusercontent.com/sfjro/aufs4-standalone/aufs4.1/aufs4-mmap.patch

So I will report the problem to aufs-users at lists.sourceforge.net

Note that different call traces were seen by my colleagues (on different debian kernels and machines), where the impact of aufs4 was less obvious (it did not crash in vma_do_fput), I don't know what to make of it...


Reply to: