On Thu, Mar 23, 2017 at 10:40:59PM +0900, Sergey Senozhatsky wrote:
>
> Hello Joonsoo,
>
> On (03/16/17 11:46), js1...@gmail.com wrote:
> [..]
> > +static bool zram_entry_put(struct zram *zram, struct zram_meta *meta,
> > + struct zram_entry *entry, bool populated)
> > +{
> > + struct zram_hash *hash;
> > + u32 checksum;
> > +
> > + if (!populated)
> > + goto free;
> > +
> > + checksum = entry->checksum;
> > + hash = &meta->hash[checksum % meta->hash_size];
> > +
> > + spin_lock(&hash->lock);
> > + entry->refcount--;
> > + if (!entry->refcount) {
> > + populated = false;
> > + rb_erase(&entry->rb_node, &hash->rb_root);
> > + RB_CLEAR_NODE(&entry->rb_node);
> > + }
> > + spin_unlock(&hash->lock);
> > +
> > +free:
> > + if (!populated)
> > + zram_entry_free(zram, meta, entry);
> > +
> > + return populated;
> > +}
>
> [ 2935.830100] BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000154
> [ 2935.830106] IP: zram_entry_put+0x15/0xbb [zram]
> [ 2935.830107] PGD 4063aa067
> [ 2935.830108] P4D 4063aa067
> [ 2935.830108] PUD 19d426067
> [ 2935.830109] PMD 0
>
> [ 2935.830110] Oops: 0000 [#1] PREEMPT SMP
> [ 2935.830111] Modules linked in: lzo zram(-) zsmalloc mousedev nls_iso8859_1
> nls_cp437 vfat fat psmouse serio_raw atkbd libps2 coretemp hwmon iwlmvm
> crc32c_intel i2c_i801 r8169 iwlwifi lpc_ich mii mfd_core ie31200_edac
> edac_core thermal i8042 serio wmi evdev acpi_cpufreq sd_mod
> [ 2935.830127] CPU: 3 PID: 1599 Comm: rmmod Tainted: G W
> 4.11.0-rc3-next-20170323-dbg-00012-gdda44065c67c-dirty #155
> [ 2935.830128] task: ffff8804061c14c0 task.stack: ffff8801f7908000
> [ 2935.830130] RIP: 0010:zram_entry_put+0x15/0xbb [zram]
> [ 2935.830131] RSP: 0018:ffff8801f790bdc0 EFLAGS: 00010246
> [ 2935.830132] RAX: 0000000000000000 RBX: ffff88041cdbfce0 RCX:
> 0000000000000001
> [ 2935.830132] RDX: ffff880405f4cdb8 RSI: ffff88041cdbfce0 RDI:
> 0000000000000000
> [ 2935.830133] RBP: ffff8801f790bde8 R08: ffffffffffffff80 R09:
> 00000000000000ff
> [ 2935.830134] R10: ffff8801f790bd90 R11: 0000000000000000 R12:
> 0000000000000000
> [ 2935.830134] R13: ffff88041cdbfce0 R14: ffff88041cdbfd00 R15:
> ffff88041cdbfce0
> [ 2935.830135] FS: 00007fb350b62b40(0000) GS:ffff88042fac0000(0000)
> knlGS:0000000000000000
> [ 2935.830136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 2935.830137] CR2: 0000000000000154 CR3: 00000002d3f53000 CR4:
> 00000000001406e0
> [ 2935.830137] Call Trace:
> [ 2935.830139] zram_meta_free+0x50/0x7e [zram]
> [ 2935.830141] zram_reset_device+0xd2/0xe5 [zram]
> [ 2935.830142] zram_remove+0x9f/0xf1 [zram]
> [ 2935.830143] ? zram_remove+0xf1/0xf1 [zram]
> [ 2935.830145] zram_remove_cb+0x11/0x15 [zram]
> [ 2935.830148] idr_for_each+0x3b/0x87
> [ 2935.830149] destroy_devices+0x2a/0x56 [zram]
> [ 2935.830150] zram_exit+0x9/0x6f6 [zram]
> [ 2935.830153] SyS_delete_module+0xf1/0x181
> [ 2935.830156] entry_SYSCALL_64_fastpath+0x18/0xad
> [ 2935.830157] RIP: 0033:0x7fb3502659b7
> [ 2935.830158] RSP: 002b:00007fff90ca5468 EFLAGS: 00000202 ORIG_RAX:
> 00000000000000b0
> [ 2935.830159] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
> 00007fb3502659b7
> [ 2935.830159] RDX: 000000000000000a RSI: 0000000000000800 RDI:
> 0000000002187208
> [ 2935.830160] RBP: 0000000000000000 R08: 00007fff90ca43e1 R09:
> 000000000000000a
> [ 2935.830161] R10: 0000000000000892 R11: 0000000000000202 R12:
> 00000000021871a0
> [ 2935.830162] R13: 00007fff90ca4450 R14: 00000000021871a0 R15:
> 0000000002186010
> [ 2935.830163] Code: 1e 6f fb ff 4c 89 e7 e8 9e 05 f5 e0 48 89 d8 5b 41 5c 41
> 5d 5d c3 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 53 <83>
> bf 54 01 00 00 00 48 89 d3 75 0e 48 8b 7e 08 48 89 d6 e8 0b
> [ 2935.830184] RIP: zram_entry_put+0x15/0xbb [zram] RSP: ffff8801f790bdc0
> [ 2935.830184] CR2: 0000000000000154
> [ 2935.838309] ---[ end trace f7f95fd0ed6c72a0 ]---
Hello,
Thanks for reporting.
I have noticed this bug and fixed it in version 2.
Thanks.
