kern/118531: tmpfs panic on mount

[Jaakko Heinonen]

>Number:         118531
>Category:       kern
>Synopsis:       tmpfs panic on mount
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 10 11:20:02 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Jaakko Heinonen
>Release:        7.0-BETA4
>Organization:
>Environment:
FreeBSD x 7.0-BETA4 FreeBSD 7.0-BETA4 #0: Sun Dec  2 19:19:04 UTC 2007     root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
Mountings panics if you use any mount option which expects a value (e.g. size, gid, uid) _without_ the value.

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc07dbd48
stack pointer           = 0x28:0xd0c2a7ec
frame pointer           = 0x28:0xd0c2a7ec
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 11782 (mount)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 8m50s
Physical memory: 371 MB
Dumping 79 MB: 64 48 32 16

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc0751987 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc0751c49 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0a1635c in trap_fatal (frame=0xd0c2a7ac, eva=0)
    at /usr/src/sys/i386/i386/trap.c:872
#4  0xc0a165e0 in trap_pfault (frame=0xd0c2a7ac, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:785
#5  0xc0a16f55 in trap (frame=0xd0c2a7ac) at /usr/src/sys/i386/i386/trap.c:463
#6  0xc09fcf7b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc07dbd48 in strlen (str=0x0) at /usr/src/sys/libkern/strlen.c:41
#8  0xc077e430 in vsscanf (inp=0x0, fmt0=0xc350dbae "%qu", 
    ap=0xd0c2a9cc "h���) at /usr/src/sys/kern/subr_scanf.c:123
#9  0xc07c2770 in vfs_scanopt (opts=0xc2976710, name=0xc350dbb2 "size", 
    fmt=0xc350dbae "%qu") at /usr/src/sys/kern/vfs_mount.c:1944
#10 0xc350b9b7 in ?? ()
#11 0xc2976710 in ?? ()
#12 0xc350dbb2 in ?? ()
#13 0xc350dbae in ?? ()
#14 0xd0c2aa68 in ?? ()
#15 0x000000dc in ?? ()
#16 0xc0966a8e in uma_zfree_arg (zone=0xc350e360, item=0xc295d840, 
    udata=0xc29767d0) at /usr/src/sys/vm/uma_core.c:2302
#17 0xc07c59db in vfs_donmount (td=0xc295d840, fsflags=0, fsoptions=0xc33eab00)
    at /usr/src/sys/kern/vfs_mount.c:1004
#18 0xc07c6dc2 in nmount (td=0xc295d840, uap=0xd0c2acfc)
    at /usr/src/sys/kern/vfs_mount.c:417
#19 0xc0a16935 in syscall (frame=0xd0c2ad38)
    at /usr/src/sys/i386/i386/trap.c:1008
#20 0xc09fcfe0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:196
#21 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

>How-To-Repeat:
# mount -t tmpfs -o size tmpfs /mnt
>Fix:
The problem is that tmpfs calls vfs_scanopt() with an option value being NULL. Following patch adds a NULL check to vfs_scanopt().

Patch attached with submission follows:

--- sys/kern/vfs_mount.c.orig	2007-11-19 13:30:38.000000000 +0200
+++ sys/kern/vfs_mount.c	2007-11-19 13:33:28.000000000 +0200
@@ -1938,7 +1938,7 @@
 	TAILQ_FOREACH(opt, opts, link) {
 		if (strcmp(name, opt->name) != 0)
 			continue;
-		if (((char *)opt->value)[opt->len - 1] != '\0')
+		if (!opt->value || ((char *)opt->value)[opt->len - 1] != '\0')
 			return (0);
 		va_start(ap, fmt);
 		ret = vsscanf(opt->value, fmt, ap);


>Release-Note:
>Audit-Trail:
>Unformatted: