Date: Mon, 10 Dec 2007 11:15:14 GMT From: Jaakko Heinonen <jh@saunalahti.fi> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/118531: tmpfs panic on mount Message-ID: <200712101115.lBABFEIt085373@www.freebsd.org> Resent-Message-ID: <200712101120.lBABK2jW082560@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 118531
>Category: kern
>Synopsis: tmpfs panic on mount
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Dec 10 11:20:02 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator: Jaakko Heinonen
>Release: 7.0-BETA4
>Organization:
>Environment:
FreeBSD x 7.0-BETA4 FreeBSD 7.0-BETA4 #0: Sun Dec 2 19:19:04 UTC 2007 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
>Description:
Mountings panics if you use any mount option which expects a value (e.g. size, gid, uid) _without_ the value.
Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x0
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc07dbd48
stack pointer = 0x28:0xd0c2a7ec
frame pointer = 0x28:0xd0c2a7ec
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 11782 (mount)
trap number = 12
panic: page fault
cpuid = 0
Uptime: 8m50s
Physical memory: 371 MB
Dumping 79 MB: 64 48 32 16
#0 doadump () at pcpu.h:195
195 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt
#0 doadump () at pcpu.h:195
#1 0xc0751987 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2 0xc0751c49 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3 0xc0a1635c in trap_fatal (frame=0xd0c2a7ac, eva=0)
at /usr/src/sys/i386/i386/trap.c:872
#4 0xc0a165e0 in trap_pfault (frame=0xd0c2a7ac, usermode=0, eva=0)
at /usr/src/sys/i386/i386/trap.c:785
#5 0xc0a16f55 in trap (frame=0xd0c2a7ac) at /usr/src/sys/i386/i386/trap.c:463
#6 0xc09fcf7b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7 0xc07dbd48 in strlen (str=0x0) at /usr/src/sys/libkern/strlen.c:41
#8 0xc077e430 in vsscanf (inp=0x0, fmt0=0xc350dbae "%qu",
ap=0xd0c2a9cc "h���) at /usr/src/sys/kern/subr_scanf.c:123
#9 0xc07c2770 in vfs_scanopt (opts=0xc2976710, name=0xc350dbb2 "size",
fmt=0xc350dbae "%qu") at /usr/src/sys/kern/vfs_mount.c:1944
#10 0xc350b9b7 in ?? ()
#11 0xc2976710 in ?? ()
#12 0xc350dbb2 in ?? ()
#13 0xc350dbae in ?? ()
#14 0xd0c2aa68 in ?? ()
#15 0x000000dc in ?? ()
#16 0xc0966a8e in uma_zfree_arg (zone=0xc350e360, item=0xc295d840,
udata=0xc29767d0) at /usr/src/sys/vm/uma_core.c:2302
#17 0xc07c59db in vfs_donmount (td=0xc295d840, fsflags=0, fsoptions=0xc33eab00)
at /usr/src/sys/kern/vfs_mount.c:1004
#18 0xc07c6dc2 in nmount (td=0xc295d840, uap=0xd0c2acfc)
at /usr/src/sys/kern/vfs_mount.c:417
#19 0xc0a16935 in syscall (frame=0xd0c2ad38)
at /usr/src/sys/i386/i386/trap.c:1008
#20 0xc09fcfe0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#21 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
>How-To-Repeat:
# mount -t tmpfs -o size tmpfs /mnt
>Fix:
The problem is that tmpfs calls vfs_scanopt() with an option value being NULL. Following patch adds a NULL check to vfs_scanopt().
Patch attached with submission follows:
--- sys/kern/vfs_mount.c.orig 2007-11-19 13:30:38.000000000 +0200
+++ sys/kern/vfs_mount.c 2007-11-19 13:33:28.000000000 +0200
@@ -1938,7 +1938,7 @@
TAILQ_FOREACH(opt, opts, link) {
if (strcmp(name, opt->name) != 0)
continue;
- if (((char *)opt->value)[opt->len - 1] != '\0')
+ if (!opt->value || ((char *)opt->value)[opt->len - 1] != '\0')
return (0);
va_start(ap, fmt);
ret = vsscanf(opt->value, fmt, ap);
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200712101115.lBABFEIt085373>