From owner-freebsd-bugs@FreeBSD.ORG Mon Dec 10 11:20:03 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 15AF816A41A for ; Mon, 10 Dec 2007 11:20:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id EA6BA13C4E3 for ; Mon, 10 Dec 2007 11:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id lBABK2eW082561 for ; Mon, 10 Dec 2007 11:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id lBABK2jW082560; Mon, 10 Dec 2007 11:20:02 GMT (envelope-from gnats) Resent-Date: Mon, 10 Dec 2007 11:20:02 GMT Resent-Message-Id: <200712101120.lBABK2jW082560@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jaakko Heinonen Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0FA9C16A417 for ; Mon, 10 Dec 2007 11:15:16 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 0121A13C465 for ; Mon, 10 Dec 2007 11:15:16 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id lBABFEuT085374 for ; Mon, 10 Dec 2007 11:15:14 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id lBABFEIt085373; Mon, 10 Dec 2007 11:15:14 GMT (envelope-from nobody) Message-Id: <200712101115.lBABFEIt085373@www.freebsd.org> Date: Mon, 10 Dec 2007 11:15:14 GMT From: Jaakko Heinonen To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/118531: tmpfs panic on mount X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2007 11:20:03 -0000 >Number: 118531 >Category: kern >Synopsis: tmpfs panic on mount >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Dec 10 11:20:02 UTC 2007 >Closed-Date: >Last-Modified: >Originator: Jaakko Heinonen >Release: 7.0-BETA4 >Organization: >Environment: FreeBSD x 7.0-BETA4 FreeBSD 7.0-BETA4 #0: Sun Dec 2 19:19:04 UTC 2007 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: Mountings panics if you use any mount option which expects a value (e.g. size, gid, uid) _without_ the value. Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x0 fault code = supervisor read, page not present instruction pointer = 0x20:0xc07dbd48 stack pointer = 0x28:0xd0c2a7ec frame pointer = 0x28:0xd0c2a7ec code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 11782 (mount) trap number = 12 panic: page fault cpuid = 0 Uptime: 8m50s Physical memory: 371 MB Dumping 79 MB: 64 48 32 16 #0 doadump () at pcpu.h:195 195 pcpu.h: No such file or directory. in pcpu.h (kgdb) bt #0 doadump () at pcpu.h:195 #1 0xc0751987 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409 #2 0xc0751c49 in panic (fmt=Variable "fmt" is not available. ) at /usr/src/sys/kern/kern_shutdown.c:563 #3 0xc0a1635c in trap_fatal (frame=0xd0c2a7ac, eva=0) at /usr/src/sys/i386/i386/trap.c:872 #4 0xc0a165e0 in trap_pfault (frame=0xd0c2a7ac, usermode=0, eva=0) at /usr/src/sys/i386/i386/trap.c:785 #5 0xc0a16f55 in trap (frame=0xd0c2a7ac) at /usr/src/sys/i386/i386/trap.c:463 #6 0xc09fcf7b in calltrap () at /usr/src/sys/i386/i386/exception.s:139 #7 0xc07dbd48 in strlen (str=0x0) at /usr/src/sys/libkern/strlen.c:41 #8 0xc077e430 in vsscanf (inp=0x0, fmt0=0xc350dbae "%qu", ap=0xd0c2a9cc "h���) at /usr/src/sys/kern/subr_scanf.c:123 #9 0xc07c2770 in vfs_scanopt (opts=0xc2976710, name=0xc350dbb2 "size", fmt=0xc350dbae "%qu") at /usr/src/sys/kern/vfs_mount.c:1944 #10 0xc350b9b7 in ?? () #11 0xc2976710 in ?? () #12 0xc350dbb2 in ?? () #13 0xc350dbae in ?? () #14 0xd0c2aa68 in ?? () #15 0x000000dc in ?? () #16 0xc0966a8e in uma_zfree_arg (zone=0xc350e360, item=0xc295d840, udata=0xc29767d0) at /usr/src/sys/vm/uma_core.c:2302 #17 0xc07c59db in vfs_donmount (td=0xc295d840, fsflags=0, fsoptions=0xc33eab00) at /usr/src/sys/kern/vfs_mount.c:1004 #18 0xc07c6dc2 in nmount (td=0xc295d840, uap=0xd0c2acfc) at /usr/src/sys/kern/vfs_mount.c:417 #19 0xc0a16935 in syscall (frame=0xd0c2ad38) at /usr/src/sys/i386/i386/trap.c:1008 #20 0xc09fcfe0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196 #21 0x00000033 in ?? () Previous frame inner to this frame (corrupt stack?) >How-To-Repeat: # mount -t tmpfs -o size tmpfs /mnt >Fix: The problem is that tmpfs calls vfs_scanopt() with an option value being NULL. Following patch adds a NULL check to vfs_scanopt(). Patch attached with submission follows: --- sys/kern/vfs_mount.c.orig 2007-11-19 13:30:38.000000000 +0200 +++ sys/kern/vfs_mount.c 2007-11-19 13:33:28.000000000 +0200 @@ -1938,7 +1938,7 @@ TAILQ_FOREACH(opt, opts, link) { if (strcmp(name, opt->name) != 0) continue; - if (((char *)opt->value)[opt->len - 1] != '\0') + if (!opt->value || ((char *)opt->value)[opt->len - 1] != '\0') return (0); va_start(ap, fmt); ret = vsscanf(opt->value, fmt, ap); >Release-Note: >Audit-Trail: >Unformatted: