mounting 9p file system fails intermittently in qemu guest

Bug #676823 reported by Mike Ryan
18
This bug affects 3 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Lucid
Fix Released
Undecided
Tim Gardner

Bug Description

$ uname -a
Linux zzz 2.6.32-25-generic #45-Ubuntu SMP Sat Oct 16 19:48:22 UTC 2010 i686 GNU/Linux

$ cat /proc/version_signature
Ubuntu 2.6.32-25.45-generic 2.6.32.21+drm33.7

Ubuntu version: lucid

Attempting to mount a 9p file system in a qemu guest fails intermittently with the error message "Unable to read superblock". I tracked this down to an uninitialized field in the virtio transport. A patch to fix it is attached.

Note: this bug has been fixed upstream in a minor release (2.6.33)

To reproduce: you must be running qemu >= 0.13
$ qemu -virtfs local,path=/tmp,security_model=passthrough,mount_tag=tmp root.img

When the system comes up, run the following command:
# mount -t 9p -o trans=virtio,version=9p2000.L tmp /tmp

The command fails intermittently with 'unable to read superblock'.

CVE References

Revision history for this message
Mike Ryan (mikeryan+launchpad) wrote :

The last patch used spaces instead of tabs. Use this one instead.

tags: added: kj-triage
Revision history for this message
Andy Whitcroft (apw) wrote :

That patch looks pretty sensible to me. Probabally it should be submitted to the upstream maintainer of the 9P filesystem for review (do remember to sign off on it). They can be contacted using the addresses below:

M: Eric Van Hensbergen <email address hidden>
M: Ron Minnich <email address hidden>
M: Latchesar Ionkov <email address hidden>
L: <email address hidden>

Changed in linux (Ubuntu):
status: New → Triaged
Tim Gardner (timg-tpi)
Changed in linux (Ubuntu):
status: Triaged → Fix Released
Changed in linux (Ubuntu Lucid):
assignee: nobody → Tim Gardner (timg-tpi)
status: New → In Progress
Revision history for this message
Tim Gardner (timg-tpi) wrote :

net/9p: fix virtio transport to correctly update status on connect
562ada612058133a5483c68a73605f3c5f42fffe upstream

Changed in linux (Ubuntu Lucid):
status: In Progress → Fix Committed
Revision history for this message
Luis Henriques (henrix) wrote :

This bug is awaiting verification that the kernel for Lucid in -proposed solves the problem (2.6.32-45.99). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lucid' to 'verification-done-lucid'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-lucid
Revision history for this message
Tim Gardner (timg-tpi) wrote :

Marking verified as this is an obvious one liner that should have come down via stable.

tags: added: verification-done-lucid
removed: verification-needed-lucid
Revision history for this message
Adam Conrad (adconrad) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (11.7 KiB)

This bug was fixed in the package linux - 2.6.32-45.99

---------------
linux (2.6.32-45.99) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1067331

  [ Tim Gardner ]

  * SAUCE: omnibook: Expose PWD for standalone builds
    - LP: #505420

  [ Upstream Kernel Changes ]

  * Revert "xfs: Fix possible memory corruption in xfs_readlink,
    CVE-2011-4077"
    - LP: #1064480
  * UBUNTU SAUCE: apparmor: fix IRQ stack overflow
    - LP: #1056078
  * net/9p: fix virtio transport to correctly update status on connect
    - LP: #676823
  * 9p: Fix the kernel crash on a failed mount
    - LP: #676823
  * netxen: support for GbE port settings
    - LP: #1064480
  * Fix sparc build with newer tools.
    - LP: #1064480
  * powerpc/pmac: Fix SMP kernels on pre-core99 UP machines
    - LP: #1064480
  * Bluetooth: btusb: fix bInterval for high/super speed isochronous
    endpoints
    - LP: #1064480
  * fix pgd_lock deadlock
    - LP: #1064480
  * futex: Fix uninterruptible loop due to gate_area
    - LP: #1064480
  * time: Improve sanity checking of timekeeping inputs
    - LP: #1064480
  * time: Avoid making adjustments if we haven't accumulated anything
    - LP: #1064480
  * time: Move ktime_t overflow checking into timespec_valid_strict
    - LP: #1064480
  * drm/i915: Attempt to fix watermark setup on 85x (v2)
    - LP: #1064480
  * ioat2: kill pending flag
    - LP: #1064480
  * usb: Fix deadlock in hid_reset when Dell iDRAC is reset
    - LP: #1064480
  * oprofile: use KM_NMI slot for kmap_atomic
    - LP: #1064480
  * tty_audit: fix tty_audit_add_data live lock on audit disabled
    - LP: #1064480
  * bonding: 802.3ad - fix agg_device_up
    - LP: #1064480
  * usbnet: increase URB reference count before usb_unlink_urb
    - LP: #1064480
  * usbnet: don't clear urb->dev in tx_complete
    - LP: #1064480
  * sched: Fix signed unsigned comparison in check_preempt_tick()
    - LP: #1064480
  * x86/PCI: amd: factor out MMCONFIG discovery
    - LP: #1064480
  * PNP: fix "work around Dell 1536/1546 BIOS MMCONFIG bug that breaks USB"
    - LP: #1064480
  * KVM: x86: disallow multiple KVM_CREATE_IRQCHIP
    - LP: #1064480
  * KVM: ia64: fix build due to typo
    - LP: #1064480
  * xfs: Fix possible memory corruption in xfs_readlink
    - LP: #1064480
  * xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink()
    - LP: #1064480
  * dl2k: use standard #defines from mii.h.
    - LP: #1064480
  * tcp: Don't change unlocked socket state in tcp_v4_err().
    - LP: #1064480
  * x86: Derandom delay_tsc for 64 bit
    - LP: #1064480
  * ipsec: be careful of non existing mac headers
    - LP: #1064480
  * block, sx8: fix pointer math issue getting fw version
    - LP: #1064480
  * nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
    - LP: #1064480
  * USB: ftdi_sio: fix problem when the manufacture is a NULL string
    - LP: #1064480
  * ntp: Fix integer overflow when setting time
    - LP: #1064480
  * SUNRPC: We must not use list_for_each_entry_safe() in rpc_wake_up()
    - LP: #1064480
  * ext4: check for zero length extent
    - LP: #1064480
  * xfs: Fix oops on IO error during xlog_recover_pr...

Changed in linux (Ubuntu Lucid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.