Vegard Nossum
1b8553c04b
9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()
The memory allocated by iov_iter_get_pages_alloc() can be allocated with
vmalloc() if kmalloc() failed -- see get_pages_array().
In that case we need to free it with vfree(), so let's use kvfree().
The bug manifests like this:
BUG: unable to handle kernel paging request at ffffeb0400072da0
IP: [<ffffffff8139c67b>] kfree+0x4b/0x140
PGD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 2 PID: 675 Comm: trinity-c2 Not tainted 4.7.0-rc7+ #14
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff8800badef2c0 ti: ffff880069208000 task.ti: ffff880069208000
RIP: 0010:[<ffffffff8139c67b>] [<ffffffff8139c67b>] kfree+0x4b/0x140
RSP: 0000:ffff88006920f3f0 EFLAGS: 00010282
RAX: ffffea0000000000 RBX: ffffc90001cb6000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffffc90001cb6000
RBP: ffff88006920f410 R08: 0000000000000000 R09: dffffc0000000000
R10: ffff8800badefa30 R11: 0000056a3d3b0d9f R12: ffff88006920f620
R13: ffffeb0400072d80 R14: ffff8800baa94078 R15: 0000000000000000
FS: 00007fbd2b437700(0000) GS:ffff88011af00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffeb0400072da0 CR3: 000000006926d000 CR4: 00000000000006e0
Stack:
0000000000000001 ffff88006920f620 ffffed001755280f ffff8800baa94078
ffff88006920f6a8 ffffffff8310442b dffffc0000000000 ffff8800badefa30
ffff8800badefa28 ffff88011af1fba0 1ffff1000d241e98 ffff8800ba892150
Call Trace:
[<ffffffff8310442b>] p9_virtio_zc_request+0x72b/0xdb0
[<ffffffff830f2116>] p9_client_zc_rpc.constprop.8+0x246/0xb10
[<ffffffff830f5d79>] p9_client_read+0x4c9/0x750
[<ffffffff8175ceac>] v9fs_fid_readpage+0x14c/0x320
[<ffffffff8175d0b6>] v9fs_vfs_readpage+0x36/0x50
[<ffffffff812c6f13>] filemap_fault+0x9a3/0xe60
[<ffffffff81331878>] __do_fault+0x158/0x300
[<ffffffff81339e01>] handle_mm_fault+0x1cf1/0x3c80
[<ffffffff810c0aaa>] __do_page_fault+0x30a/0x8e0
[<ffffffff810c10df>] do_page_fault+0x2f/0x80
[<ffffffff810b5b07>] do_async_page_fault+0x27/0xa0
[<ffffffff83296c48>] async_page_fault+0x28/0x30
Code: 00 80 41 54 53 49 01 fd 48 0f 42 05 b0 39 67 02 48 89 fb 49 01 c5 48 b8 00 00 00 00 00 ea ff ff 49 c1 ed 0c 49 c1 e5 06 49 01 c5 <49> 8b 45 20 48 8d 50 ff a8 01 4c 0f 45 ea 49 8b 55 20 48 8d 42
RIP [<ffffffff8139c67b>] kfree+0x4b/0x140
RSP <ffff88006920f3f0>
CR2: ffffeb0400072da0
---[ end trace f3d59a04bafec038 ]---
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
2016-08-09 13:42:36 +03:00 |
| .. |
|
6lowpan
|
6lowpan: ndisc: set invalid unicast short addr to unspec
|
2016-07-08 13:23:12 +02:00 |
|
9p
|
9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()
|
2016-08-09 13:42:36 +03:00 |
|
802
|
|
|
|
8021q
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
|
2016-07-24 00:53:32 -04:00 |
|
appletalk
|
|
|
|
atm
|
net: add dev arg to ndo_neigh_construct/destroy
|
2016-07-05 09:06:28 -07:00 |
|
ax25
|
AX.25: Close socket connection on session completion
|
2016-06-18 20:55:34 -07:00 |
|
batman-adv
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
|
2016-07-24 00:53:32 -04:00 |
|
bluetooth
|
Bluetooth: Add debugfs fields for hardware and firmware info
|
2016-07-18 09:33:28 +03:00 |
|
bridge
|
bridge: Fix incorrect re-injection of LLDP packets
|
2016-07-25 10:53:34 -07:00 |
|
caif
|
caif: Remove unneeded header file
|
2016-06-28 05:26:14 -04:00 |
|
can
|
can: only call can_stat_update with procfs
|
2016-06-23 11:23:49 +02:00 |
|
ceph
|
libceph: fsmap.user subscription support
|
2016-07-28 03:00:40 +02:00 |
|
core
|
Merge branch 'salted-string-hash'
|
2016-07-28 12:26:31 -07:00 |
|
dcb
|
|
|
|
dccp
|
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
|
2016-07-29 17:38:46 -07:00 |
|
decnet
|
net: fix decnet rtnexthop parsing
|
2016-07-05 14:08:47 -07:00 |
|
dns_resolver
|
KEYS: Add a facility to restrict new links into a keyring
|
2016-04-11 22:37:37 +01:00 |
|
dsa
|
net: dsa: support switchdev ageing time attr
|
2016-07-19 19:42:01 -07:00 |
|
ethernet
|
|
|
|
hsr
|
net/hsr: Use setup_timer and mod_timer.
|
2016-05-16 14:00:43 -04:00 |
|
ieee802154
|
ieee802154: 6lowpan: fix intra pan id check
|
2016-07-08 13:23:12 +02:00 |
|
ipv4
|
tcp: consider recv buf for the initial window scale
|
2016-07-30 21:21:57 -07:00 |
|
ipv6
|
net: ipv6: use list_move instead of list_del/list_add
|
2016-07-30 20:41:59 -07:00 |
|
ipx
|
|
|
|
irda
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
|
2016-07-27 12:03:20 -07:00 |
|
iucv
|
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
|
2016-07-29 17:38:46 -07:00 |
|
kcm
|
kcm: remove redundant -ve error check and return path
|
2016-07-25 11:17:16 -07:00 |
|
key
|
|
|
|
l2tp
|
l2tp: Correctly return -EBADF from pppol2tp_getname.
|
2016-07-26 15:19:46 -07:00 |
|
l3mdev
|
net: vrf: Implement get_saddr for IPv6
|
2016-06-17 21:25:29 -07:00 |
|
lapb
|
net/lapb: tuse %*ph to dump buffers
|
2016-05-29 22:33:25 -07:00 |
|
llc
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
|
2016-05-09 15:59:24 -04:00 |
|
mac80211
|
cfg80211: Add mesh peer AID setting API
|
2016-07-06 15:04:52 +02:00 |
|
mac802154
|
|
|
|
mpls
|
mpls: allow routes on ipip and sit devices
|
2016-07-09 17:45:56 -04:00 |
|
ncsi
|
net/ncsi: avoid maybe-uninitialized warning
|
2016-07-25 10:32:59 -07:00 |
|
netfilter
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
|
2016-07-27 12:03:20 -07:00 |
|
netlabel
|
netlabel: Implement CALIPSO config functions for SMACK.
|
2016-06-27 15:06:18 -04:00 |
|
netlink
|
net/netlink/af_netlink.h: Remove unused structure.
|
2016-06-09 22:26:24 -07:00 |
|
netrom
|
|
|
|
nfc
|
NFC: digital: Fix RTOX supervisor PDU handling
|
2016-07-11 02:02:03 +02:00 |
|
openvswitch
|
netfilter: conntrack: support a fixed size of 128 distinct labels
|
2016-07-22 17:04:55 +02:00 |
|
packet
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
|
2016-07-24 00:53:32 -04:00 |
|
phonet
|
|
|
|
qrtr
|
Merge tag 'qcom-soc-for-4.7-2' into net-next
|
2016-05-17 14:11:19 -04:00 |
|
rds
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
rfkill
|
rfkill: Use switch to demux userspace operations
|
2016-04-05 10:48:53 +02:00 |
|
rose
|
rose: limit sk_filter trim to payload
|
2016-07-13 11:53:40 -07:00 |
|
rxrpc
|
rxrpc: checking for IS_ERR() instead of NULL
|
2016-07-15 14:16:25 -07:00 |
|
sched
|
net_sched: get rid of struct tcf_common
|
2016-07-25 21:49:20 -07:00 |
|
sctp
|
sctp: allow receiving msg when TCP-style sk is in CLOSED state
|
2016-07-30 22:06:22 -07:00 |
|
sunrpc
|
Highlights:
|
2016-08-04 19:59:06 -04:00 |
|
switchdev
|
net/switchdev: Export the same parent ID service function
|
2016-07-14 13:34:29 -07:00 |
|
tipc
|
tipc: fix imbalance read_unlock_bh in __tipc_nl_add_monitor()
|
2016-07-30 20:38:22 -07:00 |
|
unix
|
af_unix: charge buffers to kmemcg
|
2016-07-26 16:19:19 -07:00 |
|
vmw_vsock
|
VSOCK: Add Makefile and Kconfig
|
2016-08-02 02:57:30 +03:00 |
|
wimax
|
|
|
|
wireless
|
tree-wide: replace config_enabled() with IS_ENABLED()
|
2016-08-04 08:50:07 -04:00 |
|
x25
|
net: fix a kernel infoleak in x25 module
|
2016-05-09 22:45:33 -04:00 |
|
xfrm
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
|
2016-05-09 15:59:24 -04:00 |
|
compat.c
|
packet: compat support for sock_fprog
|
2016-06-09 23:41:03 -07:00 |
|
Kconfig
|
net/ncsi: Resource management
|
2016-07-19 20:49:16 -07:00 |
|
Makefile
|
net/ncsi: Resource management
|
2016-07-19 20:49:16 -07:00 |
|
socket.c
|
fs: poll/select/recvmmsg: use timespec64 for timeout events
|
2016-05-19 19:12:14 -07:00 |
|
sysctl_net.c
|
net: Use ns_capable_noaudit() when determining net sysctl permissions
|
2016-06-06 20:16:22 +10:00 |