| Message ID | 20250210131719.528717-1-quzicheng@huawei.com (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Headers | show |
| Series | acct: Prevent NULL pointer dereference when writing to sysfs | expand |
On Mon, Feb 10, 2025 at 01:17:19PM +0000, Zicheng Qu wrote: > The acct feature is designed to write process records to specified > files, typically paths like /var/log/pacct. However, writing to sysfs > paths (e.g., /sys/power/resume) maylead to a NULL pointer dereference > issue. The acct() should not write to sysfs. > > When call the acct() with a sysfs path, such as /sys/power/resume, the > process exit via do_exit(), it calls exit_fs() to clean up fs_struct > inside. Subsequently, exit_task_work() calls acct_pin_kill(), triggering > sysfs operations. This invokes the hibernate resume_store(). Since the > fs_struct has been cleaned, it results in a NULL pointer dereference. This is a mess. As an immediate fix what you're doing will stop the bleeding for sysfs only. But who knows what people can do if they pass in a procfs or some other special sauce filesystem path. There's no guarantee that there isn't an internal lookup that's somehow triggered in some filesystem by this accounting nonsense. One fix would be to move exit_fs() past exit_task_work(). It looks like that this should be doable without much of a problem and it would fix the path_init() problem. There should hopefully be nothing relying on task->fs == NULL in exit_task_work(). There's other solutions but they all get increasingly disgusting or maybe I'm not imaginative enough rn. But bigger picture: Can we try and get rid of that accounting stuff? We could start by making acct(2) return -ENOSYS unconditionally for a start and see if anything does actually break. > This patch ensures that acct does not attempt to write to sysfs paths, > preventing the described issue. > > [ 220.064848][ T4630] Unable to handle kernel paging request at virtual address dfff800000000001 > [ 220.073744][ T4630] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] > [ 220.080847][ T4630] Mem abort info: > [ 220.088915][ T4630] ESR = 0x0000000096000004 > [ 220.088921][ T4630] EC = 0x25: DABT (current EL), IL = 32 bits > [ 220.088925][ T4630] SET = 0, FnV = 0 > [ 220.088927][ T4630] EA = 0, S1PTW = 0 > [ 220.088930][ T4630] FSC = 0x04: level 0 translation fault > [ 220.088933][ T4630] Data abort info: > [ 220.088934][ T4630] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 > [ 220.088937][ T4630] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 > [ 220.088940][ T4630] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 > [ 220.088943][ T4630] [dfff800000000001] address between user and kernel address ranges > [ 220.088949][ T4630] Internal error: Oops: 0000000096000004 [#1] SMP > [ 220.098020][ T4630] Modules linked in: > [ 220.104001][ T4630] > [ 220.104007][ T4630] CPU: 1 PID: 4630 Comm: syz.14.167 Not tainted 6.6.0-qzc-20250207-+ #16 > [ 220.104014][ T4630] Hardware name: linux,dummy-virt (DT) > [ 220.104017][ T4630] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 220.104023][ T4630] pc : path_init+0x61c/0x1710 > [ 220.104036][ T4630] lr : path_init+0x5f4/0x1710 > [ 220.104042][ T4630] sp : ffff800083c86e20 > [ 220.104044][ T4630] x29: ffff800083c86e20 x28: 0000000000000000 x27: dfff800000000000 > [ 220.109465][ T4630] > [ 220.109469][ T4630] x26: 0000000000000000 > [ 220.114307][ T4630] x25: 0000000000000008 x24: 0000000000000041 > [ 220.114316][ T4630] x23: ffff303e696a2220 x22: 1ffff00010790e08 x21: ffff800083c87060 > [ 220.114324][ T4630] x20: 1ffff00010790e0c x19: ffff800083c87040 x18: 0000000000000000 > [ 220.114331][ T4630] x17: 756e203a73692074 x16: 63757274735f7366 x15: 202c292865726f74 > [ 220.114339][ T4630] x14: 735f656d75736572 x13: 205d303336345420 x12: 0000000000000005 > [ 220.114346][ T4630] x11: ffff800083c87070 x10: ffff800083c87048 x9 : dfff800000000001 > [ 220.114354][ T4630] x8 : 00008fffef86f294 > [ 220.119872][ T4630] x7 : ffff800083c87080 > [ 220.126082][ T4630] x6 : 0000000000000003 > [ 220.126089][ T4630] x5 : ffff800083c86b60 x4 : ffff700010790d6d x3 : 1ffff00010790ddc > [ 220.126097][ T4630] x2 : 0000000000000000 x1 : ffff303e680f1540 x0 : 0000000000000032 > [ 220.126105][ T4630] Call trace: > [ 220.126108][ T4630] path_init+0x61c/0x1710 > [ 220.152138][ T4630] path_lookupat+0x3c/0x590 > [ 220.152150][ T4630] filename_lookup+0x144/0x410 > [ 220.152155][ T4630] kern_path+0x44/0x70 > [ 220.152158][ T4630] lookup_bdev+0xb8/0x220 > [ 220.158873][ T4630] resume_store+0x1d8/0x3f8 > [ 220.158882][ T4630] kobj_attr_store+0x3c/0x70 > [ 220.163343][ T4630] sysfs_kf_write+0xfc/0x188 > [ 220.163352][ T4630] kernfs_fop_write_iter+0x274/0x3e0 > [ 220.163356][ T4630] __kernel_write_iter+0x1c4/0x600 > [ 220.163363][ T4630] __kernel_write+0xbc/0x100 > [ 220.163368][ T4630] do_acct_process+0x3e8/0x620 > [ 220.163374][ T4630] acct_pin_kill+0xa0/0x190 > [ 220.163379][ T4630] pin_kill+0x164/0x610 > [ 220.163384][ T4630] mnt_pin_kill+0x50/0x98 > [ 220.169427][ T4630] cleanup_mnt+0x24c/0x2c8 > [ 220.169438][ T4630] __cleanup_mnt+0x1c/0x30 > [ 220.169443][ T4630] task_work_run+0x17c/0x308 > [ 220.169449][ T4630] do_exit+0x3ac/0xa30 > [ 220.169455][ T4630] do_group_exit+0x100/0x348 > [ 220.169460][ T4630] get_signal+0x107c/0x10f8 > [ 220.169464][ T4630] do_signal+0x160/0x400 > [ 220.169468][ T4630] do_notify_resume+0x1c4/0x470 > [ 220.169472][ T4630] el0_svc+0x1c0/0x1e8 > [ 220.169479][ T4630] el0t_64_sync_handler+0xc0/0xc8 > [ 220.169482][ T4630] el0t_64_sync+0x188/0x190 > [ 220.169489][ T4630] Code: 91010267 d343fe76 9100c26b 9100226a (39c00120) > [ 220.174309][ T4630] ---[ end trace 0000000000000000 ]--- > [ 220.174316][ T4630] Kernel panic - not syncing: Oops: Fatal exception > [ 220.174319][ T4630] SMP: stopping secondary CPUs > [ 220.174387][ T4630] Kernel Offset: 0x3dd279e00000 from 0xffff800080000000 > [ 220.174391][ T4630] PHYS_OFFSET: 0xffffcfc2c0000000 > [ 220.174394][ T4630] CPU features: 0x00,00000008,00002009,e0080000,1000421b > [ 220.174398][ T4630] Memory Limit: none > [ 220.347443][ T4630] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- > > Fixes: 669abf4e5539 ("vfs: make path_openat take a struct filename pointer") > Cc: stable@vger.kernel.org > Signed-off-by: Zicheng Qu <quzicheng@huawei.com> > --- > kernel/acct.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/kernel/acct.c b/kernel/acct.c > index 31222e8cd534..0beee5effee7 100644 > --- a/kernel/acct.c > +++ b/kernel/acct.c > @@ -239,6 +239,14 @@ static int acct_on(struct filename *pathname) > filp_close(file, NULL); > return -EIO; > } > + > + mnt = file->f_path.mnt; > + if (mnt->mnt_sb->s_magic == SYSFS_MAGIC) { > + kfree(acct); > + filp_close(file, NULL); > + return -EINVAL; > + } > + > internal = mnt_clone_internal(&file->f_path); > if (IS_ERR(internal)) { > kfree(acct); > @@ -252,7 +260,7 @@ static int acct_on(struct filename *pathname) > filp_close(file, NULL); > return err; > } > - mnt = file->f_path.mnt; > + > file->f_path.mnt = internal; > > atomic_long_set(&acct->count, 1); > -- > 2.34.1 >
On Mon, Feb 10, 2025 at 04:12:54PM +0100, Christian Brauner wrote: > One fix would be to move exit_fs() past exit_task_work(). It looks like > that this should be doable without much of a problem and it would fix > the path_init() problem. > > There should hopefully be nothing relying on task->fs == NULL in > exit_task_work(). There's a question of the task_work_add() issued by exit_task_fs(), though.
On Mon, Feb 10, 2025 at 03:21:46PM +0000, Al Viro wrote: > On Mon, Feb 10, 2025 at 04:12:54PM +0100, Christian Brauner wrote: > > > One fix would be to move exit_fs() past exit_task_work(). It looks like > > that this should be doable without much of a problem and it would fix > > the path_init() problem. > > > > There should hopefully be nothing relying on task->fs == NULL in > > exit_task_work(). > > There's a question of the task_work_add() issued by exit_task_fs(), > though. Can't we simply remove the pins on the mounts of fs->root and fs->pwd in exit_fs() explicitly? If that works I think that's a fair enough compromise for this shite.
On Mon, Feb 10, 2025 at 05:02:35PM +0100, Christian Brauner wrote: > On Mon, Feb 10, 2025 at 03:21:46PM +0000, Al Viro wrote: > > On Mon, Feb 10, 2025 at 04:12:54PM +0100, Christian Brauner wrote: > > > > > One fix would be to move exit_fs() past exit_task_work(). It looks like > > > that this should be doable without much of a problem and it would fix > > > the path_init() problem. > > > > > > There should hopefully be nothing relying on task->fs == NULL in > > > exit_task_work(). > > > > There's a question of the task_work_add() issued by exit_task_fs(), > > though. > > Can't we simply remove the pins on the mounts of fs->root and fs->pwd in > exit_fs() explicitly? If that works I think that's a fair enough > compromise for this shite. I'd rather go for a simpler approach... Why do we need those writes to be done in context of exiting process in the first place? It's not as if they needed to go out before it terminates, so what's to stop us from having a kernel thread in background and queue the data to be written for it to pick up? Does anybody see problems with that approach?
On Mon, Feb 10, 2025 at 06:19:02PM +0000, Al Viro wrote: > On Mon, Feb 10, 2025 at 05:02:35PM +0100, Christian Brauner wrote: > > On Mon, Feb 10, 2025 at 03:21:46PM +0000, Al Viro wrote: > > > On Mon, Feb 10, 2025 at 04:12:54PM +0100, Christian Brauner wrote: > > > > > > > One fix would be to move exit_fs() past exit_task_work(). It looks like > > > > that this should be doable without much of a problem and it would fix > > > > the path_init() problem. > > > > > > > > There should hopefully be nothing relying on task->fs == NULL in > > > > exit_task_work(). > > > > > > There's a question of the task_work_add() issued by exit_task_fs(), > > > though. > > > > Can't we simply remove the pins on the mounts of fs->root and fs->pwd in > > exit_fs() explicitly? If that works I think that's a fair enough > > compromise for this shite. > > I'd rather go for a simpler approach... Why do we need those writes > to be done in context of exiting process in the first place? It's > not as if they needed to go out before it terminates, so what's to > stop us from having a kernel thread in background and queue the data > to be written for it to pick up? > > Does anybody see problems with that approach? Note, BTW, that games with rlimit and creds switching disappear if done that way. FWIW, I wonder if we should simply allocate a page worth of buffer, occupied by acct_t array, with count + pointer to buffer kept in acct, with acct->mutex used to protect the entire thing, so that do_acct_process() would add a record to that sucker and wake the kthread up, with kthread handling actual writes and emptying the buffer. No need for exit(2) to wait unless the buffer is full...
On Tue, Feb 11, 2025 at 12:23:08AM +0000, Al Viro wrote: > On Mon, Feb 10, 2025 at 06:19:02PM +0000, Al Viro wrote: > > On Mon, Feb 10, 2025 at 05:02:35PM +0100, Christian Brauner wrote: > > > On Mon, Feb 10, 2025 at 03:21:46PM +0000, Al Viro wrote: > > > > On Mon, Feb 10, 2025 at 04:12:54PM +0100, Christian Brauner wrote: > > > > > > > > > One fix would be to move exit_fs() past exit_task_work(). It looks like > > > > > that this should be doable without much of a problem and it would fix > > > > > the path_init() problem. > > > > > > > > > > There should hopefully be nothing relying on task->fs == NULL in > > > > > exit_task_work(). > > > > > > > > There's a question of the task_work_add() issued by exit_task_fs(), > > > > though. > > > > > > Can't we simply remove the pins on the mounts of fs->root and fs->pwd in > > > exit_fs() explicitly? If that works I think that's a fair enough > > > compromise for this shite. > > > > I'd rather go for a simpler approach... Why do we need those writes > > to be done in context of exiting process in the first place? It's > > not as if they needed to go out before it terminates, so what's to > > stop us from having a kernel thread in background and queue the data > > to be written for it to pick up? > > > > Does anybody see problems with that approach? > > Note, BTW, that games with rlimit and creds switching disappear if done > that way. > > FWIW, I wonder if we should simply allocate a page worth of buffer, > occupied by acct_t array, with count + pointer to buffer kept in acct, > with acct->mutex used to protect the entire thing, so that do_acct_process() > would add a record to that sucker and wake the kthread up, with kthread > handling actual writes and emptying the buffer. No need for exit(2) > to wait unless the buffer is full... I had thought about it but both LTP and the selftests want the buffer to be filled after the process exits. So let's not overly complicate this. I want this to be as simple as possible and then start deprecating this api asap. I have a patch that just moves the final write into the workqueue. But let's keep the cred override because who knows what security hole we open up if we skip the override cred.
In [1] it was reported that the acct(2) system call can be used to
trigger a NULL deref in cases where it is set to write to a file that
triggers an internal lookup.
This can e.g., happen when pointing acct(2) to /sys/power/resume. At the
point the where the write to this file happens the calling task has
already exited and called exit_fs() but an internal lookup might be
triggered through lookup_bdev(). This may trigger a NULL-deref
when accessing current->fs.
This series does two things:
- Reorganize the code so that the the final write happens from the
workqueue but with the caller's credentials. This preserves the
(strange) permission model and has almost no regression risk.
- Block access to kernel internal filesystems as well as procfs and
sysfs in the first place.
This api should stop to exist imho.
Link: https://lore.kernel.org/r/20250127091811.3183623-1-quzicheng@huawei.com [1]
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
Christian Brauner (2):
acct: perform last write from workqueue
acct: block access to kernel internal filesystems
kernel/acct.c | 134 ++++++++++++++++++++++++++++++++++++----------------------
1 file changed, 84 insertions(+), 50 deletions(-)
---
base-commit: af69e27b3c8240f7889b6c457d71084458984d8e
change-id: 20250211-work-acct-a6d8e92a5fe0
On Tue, 2025-02-11 at 18:15 +0100, Christian Brauner wrote: > In [1] it was reported that the acct(2) system call can be used to > trigger a NULL deref in cases where it is set to write to a file that > triggers an internal lookup. > > This can e.g., happen when pointing acct(2) to /sys/power/resume. At the > point the where the write to this file happens the calling task has > already exited and called exit_fs() but an internal lookup might be > triggered through lookup_bdev(). This may trigger a NULL-deref > when accessing current->fs. > > This series does two things: > > - Reorganize the code so that the the final write happens from the > workqueue but with the caller's credentials. This preserves the > (strange) permission model and has almost no regression risk. > > - Block access to kernel internal filesystems as well as procfs and > sysfs in the first place. > > This api should stop to exist imho. > I wonder who uses it these days, and what would we suggest they replace it with? Maybe syscall auditing? config BSD_PROCESS_ACCT bool "BSD Process Accounting" depends on MULTIUSER help If you say Y here, a user level program will be able to instruct the kernel (via a special system call) to write process accounting information to a file: whenever a process exits, information about that process will be appended to the file by the kernel. The information includes things such as creation time, owning user, command name, memory usage, controlling terminal etc. (the complete list is in the struct acct in <file:include/linux/acct.h>). It is up to the user level program to do useful things with this information. This is generally a good idea, so say Y. Maybe at least time to replace that last sentence and make this default to 'n'? > Link: https://lore.kernel.org/r/20250127091811.3183623-1-quzicheng@huawei.com [1] > > Signed-off-by: Christian Brauner <brauner@kernel.org> > --- > Christian Brauner (2): > acct: perform last write from workqueue > acct: block access to kernel internal filesystems > > kernel/acct.c | 134 ++++++++++++++++++++++++++++++++++++---------------------- > 1 file changed, 84 insertions(+), 50 deletions(-) > --- > base-commit: af69e27b3c8240f7889b6c457d71084458984d8e > change-id: 20250211-work-acct-a6d8e92a5fe0 >
On Tue, Feb 11, 2025 at 01:56:41PM -0500, Jeff Layton wrote: > On Tue, 2025-02-11 at 18:15 +0100, Christian Brauner wrote: > > In [1] it was reported that the acct(2) system call can be used to > > trigger a NULL deref in cases where it is set to write to a file that > > triggers an internal lookup. > > > > This can e.g., happen when pointing acct(2) to /sys/power/resume. At the > > point the where the write to this file happens the calling task has > > already exited and called exit_fs() but an internal lookup might be > > triggered through lookup_bdev(). This may trigger a NULL-deref > > when accessing current->fs. > > > > This series does two things: > > > > - Reorganize the code so that the the final write happens from the > > workqueue but with the caller's credentials. This preserves the > > (strange) permission model and has almost no regression risk. > > > > - Block access to kernel internal filesystems as well as procfs and > > sysfs in the first place. > > > > This api should stop to exist imho. > > > > I wonder who uses it these days, and what would we suggest they replace > it with? Maybe syscall auditing? Someone pointed me to atop but that also works without it. Since this is a privileged api I think the natural candidate to replace all of this is bpf. I'm pretty sure that it's relatively straightforward to get a lot more information out of it than with acct(2) and it will probably be more performant too. Without any limitations as it is right now, acct(2) can easily lockup the system quite easily by pointing it to various things in sysfs and I'm sure it can be abused in other ways. So I wouldn't enable it. > > config BSD_PROCESS_ACCT > bool "BSD Process Accounting" > depends on MULTIUSER > help > If you say Y here, a user level program will be able to instruct the > kernel (via a special system call) to write process accounting > information to a file: whenever a process exits, information about > that process will be appended to the file by the kernel. The > information includes things such as creation time, owning user, > command name, memory usage, controlling terminal etc. (the complete > list is in the struct acct in <file:include/linux/acct.h>). It is > up to the user level program to do useful things with this > information. This is generally a good idea, so say Y. > > Maybe at least time to replace that last sentence and make this default > to 'n'? I agree. > > > Link: https://lore.kernel.org/r/20250127091811.3183623-1-quzicheng@huawei.com [1] > > > > Signed-off-by: Christian Brauner <brauner@kernel.org> > > --- > > Christian Brauner (2): > > acct: perform last write from workqueue > > acct: block access to kernel internal filesystems > > > > kernel/acct.c | 134 ++++++++++++++++++++++++++++++++++++---------------------- > > 1 file changed, 84 insertions(+), 50 deletions(-) > > --- > > base-commit: af69e27b3c8240f7889b6c457d71084458984d8e > > change-id: 20250211-work-acct-a6d8e92a5fe0 > > > > -- > Jeff Layton <jlayton@kernel.org>
On Wed, Feb 12, 2025 at 12:16:44PM +0100, Christian Brauner wrote: > On Tue, Feb 11, 2025 at 01:56:41PM -0500, Jeff Layton wrote: > > On Tue, 2025-02-11 at 18:15 +0100, Christian Brauner wrote: > > > In [1] it was reported that the acct(2) system call can be used to > > > trigger a NULL deref in cases where it is set to write to a file that > > > triggers an internal lookup. > > > > > > This can e.g., happen when pointing acct(2) to /sys/power/resume. At the > > > point the where the write to this file happens the calling task has > > > already exited and called exit_fs() but an internal lookup might be > > > triggered through lookup_bdev(). This may trigger a NULL-deref > > > when accessing current->fs. > > > > > > This series does two things: > > > > > > - Reorganize the code so that the the final write happens from the > > > workqueue but with the caller's credentials. This preserves the > > > (strange) permission model and has almost no regression risk. > > > > > > - Block access to kernel internal filesystems as well as procfs and > > > sysfs in the first place. > > > > > > This api should stop to exist imho. > > > > > > > I wonder who uses it these days, and what would we suggest they replace > > it with? Maybe syscall auditing? > > Someone pointed me to atop but that also works without it. Since this is > a privileged api I think the natural candidate to replace all of this is > bpf. I'm pretty sure that it's relatively straightforward to get a lot > more information out of it than with acct(2) and it will probably be > more performant too. > > Without any limitations as it is right now, acct(2) can easily lockup > the system quite easily by pointing it to various things in sysfs and > I'm sure it can be abused in other ways. So I wouldn't enable it. And I totally forgot about taskstats via Netlink: https://www.kernel.org/doc/Documentation/accounting/taskstats.txt include/uapi/linux/taskstats.h
diff --git a/kernel/acct.c b/kernel/acct.c index 31222e8cd534..0beee5effee7 100644 --- a/kernel/acct.c +++ b/kernel/acct.c @@ -239,6 +239,14 @@ static int acct_on(struct filename *pathname) filp_close(file, NULL); return -EIO; } + + mnt = file->f_path.mnt; + if (mnt->mnt_sb->s_magic == SYSFS_MAGIC) { + kfree(acct); + filp_close(file, NULL); + return -EINVAL; + } + internal = mnt_clone_internal(&file->f_path); if (IS_ERR(internal)) { kfree(acct); @@ -252,7 +260,7 @@ static int acct_on(struct filename *pathname) filp_close(file, NULL); return err; } - mnt = file->f_path.mnt; + file->f_path.mnt = internal; atomic_long_set(&acct->count, 1);
The acct feature is designed to write process records to specified files, typically paths like /var/log/pacct. However, writing to sysfs paths (e.g., /sys/power/resume) maylead to a NULL pointer dereference issue. The acct() should not write to sysfs. When call the acct() with a sysfs path, such as /sys/power/resume, the process exit via do_exit(), it calls exit_fs() to clean up fs_struct inside. Subsequently, exit_task_work() calls acct_pin_kill(), triggering sysfs operations. This invokes the hibernate resume_store(). Since the fs_struct has been cleaned, it results in a NULL pointer dereference. This patch ensures that acct does not attempt to write to sysfs paths, preventing the described issue. [ 220.064848][ T4630] Unable to handle kernel paging request at virtual address dfff800000000001 [ 220.073744][ T4630] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 220.080847][ T4630] Mem abort info: [ 220.088915][ T4630] ESR = 0x0000000096000004 [ 220.088921][ T4630] EC = 0x25: DABT (current EL), IL = 32 bits [ 220.088925][ T4630] SET = 0, FnV = 0 [ 220.088927][ T4630] EA = 0, S1PTW = 0 [ 220.088930][ T4630] FSC = 0x04: level 0 translation fault [ 220.088933][ T4630] Data abort info: [ 220.088934][ T4630] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 220.088937][ T4630] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 220.088940][ T4630] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 220.088943][ T4630] [dfff800000000001] address between user and kernel address ranges [ 220.088949][ T4630] Internal error: Oops: 0000000096000004 [#1] SMP [ 220.098020][ T4630] Modules linked in: [ 220.104001][ T4630] [ 220.104007][ T4630] CPU: 1 PID: 4630 Comm: syz.14.167 Not tainted 6.6.0-qzc-20250207-+ #16 [ 220.104014][ T4630] Hardware name: linux,dummy-virt (DT) [ 220.104017][ T4630] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 220.104023][ T4630] pc : path_init+0x61c/0x1710 [ 220.104036][ T4630] lr : path_init+0x5f4/0x1710 [ 220.104042][ T4630] sp : ffff800083c86e20 [ 220.104044][ T4630] x29: ffff800083c86e20 x28: 0000000000000000 x27: dfff800000000000 [ 220.109465][ T4630] [ 220.109469][ T4630] x26: 0000000000000000 [ 220.114307][ T4630] x25: 0000000000000008 x24: 0000000000000041 [ 220.114316][ T4630] x23: ffff303e696a2220 x22: 1ffff00010790e08 x21: ffff800083c87060 [ 220.114324][ T4630] x20: 1ffff00010790e0c x19: ffff800083c87040 x18: 0000000000000000 [ 220.114331][ T4630] x17: 756e203a73692074 x16: 63757274735f7366 x15: 202c292865726f74 [ 220.114339][ T4630] x14: 735f656d75736572 x13: 205d303336345420 x12: 0000000000000005 [ 220.114346][ T4630] x11: ffff800083c87070 x10: ffff800083c87048 x9 : dfff800000000001 [ 220.114354][ T4630] x8 : 00008fffef86f294 [ 220.119872][ T4630] x7 : ffff800083c87080 [ 220.126082][ T4630] x6 : 0000000000000003 [ 220.126089][ T4630] x5 : ffff800083c86b60 x4 : ffff700010790d6d x3 : 1ffff00010790ddc [ 220.126097][ T4630] x2 : 0000000000000000 x1 : ffff303e680f1540 x0 : 0000000000000032 [ 220.126105][ T4630] Call trace: [ 220.126108][ T4630] path_init+0x61c/0x1710 [ 220.152138][ T4630] path_lookupat+0x3c/0x590 [ 220.152150][ T4630] filename_lookup+0x144/0x410 [ 220.152155][ T4630] kern_path+0x44/0x70 [ 220.152158][ T4630] lookup_bdev+0xb8/0x220 [ 220.158873][ T4630] resume_store+0x1d8/0x3f8 [ 220.158882][ T4630] kobj_attr_store+0x3c/0x70 [ 220.163343][ T4630] sysfs_kf_write+0xfc/0x188 [ 220.163352][ T4630] kernfs_fop_write_iter+0x274/0x3e0 [ 220.163356][ T4630] __kernel_write_iter+0x1c4/0x600 [ 220.163363][ T4630] __kernel_write+0xbc/0x100 [ 220.163368][ T4630] do_acct_process+0x3e8/0x620 [ 220.163374][ T4630] acct_pin_kill+0xa0/0x190 [ 220.163379][ T4630] pin_kill+0x164/0x610 [ 220.163384][ T4630] mnt_pin_kill+0x50/0x98 [ 220.169427][ T4630] cleanup_mnt+0x24c/0x2c8 [ 220.169438][ T4630] __cleanup_mnt+0x1c/0x30 [ 220.169443][ T4630] task_work_run+0x17c/0x308 [ 220.169449][ T4630] do_exit+0x3ac/0xa30 [ 220.169455][ T4630] do_group_exit+0x100/0x348 [ 220.169460][ T4630] get_signal+0x107c/0x10f8 [ 220.169464][ T4630] do_signal+0x160/0x400 [ 220.169468][ T4630] do_notify_resume+0x1c4/0x470 [ 220.169472][ T4630] el0_svc+0x1c0/0x1e8 [ 220.169479][ T4630] el0t_64_sync_handler+0xc0/0xc8 [ 220.169482][ T4630] el0t_64_sync+0x188/0x190 [ 220.169489][ T4630] Code: 91010267 d343fe76 9100c26b 9100226a (39c00120) [ 220.174309][ T4630] ---[ end trace 0000000000000000 ]--- [ 220.174316][ T4630] Kernel panic - not syncing: Oops: Fatal exception [ 220.174319][ T4630] SMP: stopping secondary CPUs [ 220.174387][ T4630] Kernel Offset: 0x3dd279e00000 from 0xffff800080000000 [ 220.174391][ T4630] PHYS_OFFSET: 0xffffcfc2c0000000 [ 220.174394][ T4630] CPU features: 0x00,00000008,00002009,e0080000,1000421b [ 220.174398][ T4630] Memory Limit: none [ 220.347443][ T4630] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- Fixes: 669abf4e5539 ("vfs: make path_openat take a struct filename pointer") Cc: stable@vger.kernel.org Signed-off-by: Zicheng Qu <quzicheng@huawei.com> --- kernel/acct.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)