iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Weston Andros Adamson f494a6071d NFSv4: fix NULL dereference in open recover 
_nfs4_opendata_reclaim_to_nfs4_state doesn't expect to see a cached
open CLAIM_PREVIOUS, but this can happen. An example is when there are
RDWR openers and RDONLY openers on a delegation stateid. The recovery
path will first try an open CLAIM_PREVIOUS for the RDWR openers, this
marks the delegation as not needing RECLAIM anymore, so the open
CLAIM_PREVIOUS for the RDONLY openers will not actually send an rpc.

The NULL dereference is due to _nfs4_opendata_reclaim_to_nfs4_state
returning PTR_ERR(rpc_status) when !rpc_done. When the open is
cached, rpc_done == 0 and rpc_status == 0, thus
_nfs4_opendata_reclaim_to_nfs4_state returns NULL - this is unexpected
by callers of nfs4_opendata_to_nfs4_state().

This can be reproduced easily by opening the same file two times on an
NFSv4.0 mount with delegations enabled, once as RDWR and once as RDONLY then
sleeping for a long time.  While the files are held open, kick off state
recovery and this NULL dereference will be hit every time.

An example OOPS:

[   65.003602] BUG: unable to handle kernel NULL pointer dereference at 00000000
00000030
[   65.005312] IP: [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4]
[   65.006820] PGD 7b0ea067 PUD 791ff067 PMD 0
[   65.008075] Oops: 0000 [#1] SMP
[   65.008802] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache
snd_ens1371 gameport nfsd snd_rawmidi snd_ac97_codec ac97_bus btusb snd_seq snd
_seq_device snd_pcm ppdev bluetooth auth_rpcgss coretemp snd_page_alloc crc32_pc
lmul crc32c_intel ghash_clmulni_intel microcode rfkill nfs_acl vmw_balloon serio
_raw snd_timer lockd parport_pc e1000 snd soundcore parport i2c_piix4 shpchp vmw
_vmci sunrpc ata_generic mperf pata_acpi mptspi vmwgfx ttm scsi_transport_spi dr
m mptscsih mptbase i2c_core
[   65.018684] CPU: 0 PID: 473 Comm: 192.168.10.85-m Not tainted 3.11.2-201.fc19
.x86_64 #1
[   65.020113] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 07/31/2013
[   65.022012] task: ffff88003707e320 ti: ffff88007b906000 task.ti: ffff88007b906000
[   65.023414] RIP: 0010:[<ffffffffa037d6ee>]  [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4]
[   65.025079] RSP: 0018:ffff88007b907d10  EFLAGS: 00010246
[   65.026042] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   65.027321] RDX: 0000000000000050 RSI: 0000000000000001 RDI: 0000000000000000
[   65.028691] RBP: ffff88007b907d38 R08: 0000000000016f60 R09: 0000000000000000
[   65.029990] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[   65.031295] R13: 0000000000000050 R14: 0000000000000000 R15: 0000000000000001
[   65.032527] FS:  0000000000000000(0000) GS:ffff88007f600000(0000) knlGS:0000000000000000
[   65.033981] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   65.035177] CR2: 0000000000000030 CR3: 000000007b27f000 CR4: 00000000000407f0
[   65.036568] Stack:
[   65.037011]  0000000000000000 0000000000000001 ffff88007b907d90 ffff88007a880220
[   65.038472]  ffff88007b768de8 ffff88007b907d48 ffffffffa037e4a5 ffff88007b907d80
[   65.039935]  ffffffffa036a6c8 ffff880037020e40 ffff88007a880000 ffff880037020e40
[   65.041468] Call Trace:
[   65.042050]  [<ffffffffa037e4a5>] nfs4_close_state+0x15/0x20 [nfsv4]
[   65.043209]  [<ffffffffa036a6c8>] nfs4_open_recover_helper+0x148/0x1f0 [nfsv4]
[   65.044529]  [<ffffffffa036a886>] nfs4_open_recover+0x116/0x150 [nfsv4]
[   65.045730]  [<ffffffffa036d98d>] nfs4_open_reclaim+0xad/0x150 [nfsv4]
[   65.046905]  [<ffffffffa037d979>] nfs4_do_reclaim+0x149/0x5f0 [nfsv4]
[   65.048071]  [<ffffffffa037e1dc>] nfs4_run_state_manager+0x3bc/0x670 [nfsv4]
[   65.049436]  [<ffffffffa037de20>] ? nfs4_do_reclaim+0x5f0/0x5f0 [nfsv4]
[   65.050686]  [<ffffffffa037de20>] ? nfs4_do_reclaim+0x5f0/0x5f0 [nfsv4]
[   65.051943]  [<ffffffff81088640>] kthread+0xc0/0xd0
[   65.052831]  [<ffffffff81088580>] ? insert_kthread_work+0x40/0x40
[   65.054697]  [<ffffffff8165686c>] ret_from_fork+0x7c/0xb0
[   65.056396]  [<ffffffff81088580>] ? insert_kthread_work+0x40/0x40
[   65.058208] Code: 5c 41 5d 5d c3 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 89 d5 41 54 53 48 89 fb <4c> 8b 67 30 f0 41 ff 44 24 44 49 8d 7c 24 40 e8 0e 0a 2d e1 44
[   65.065225] RIP  [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4]
[   65.067175]  RSP <ffff88007b907d10>
[   65.068570] CR2: 0000000000000030
[   65.070098] ---[ end trace 0d1fe4f5c7dd6f8b ]---

Cc: <stable@vger.kernel.org> #3.7+
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2013-10-28 14:53:32 -04:00
..
9p
9p: don't forget to destroy inode cache if fscache registration fails
2013-09-17 22:31:01 -04:00
adfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
affs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
afs
afs: dget_parent() can't return a negative dentry
2013-09-29 22:02:24 -04:00
autofs4
autofs4: close the races around autofs4_notify_daemon()
2013-09-16 19:16:38 -04:00
befs
[readdir] convert befs
2013-06-29 12:56:55 +04:00
bfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
btrfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
2013-09-22 14:58:49 -07:00
cachefiles
CacheFiles: Don't try to dump the index key if the cookie has been cleared
2013-09-20 15:15:43 -07:00
ceph
ceph: use d_invalidate() to invalidate aliases
2013-09-06 12:55:29 -07:00
cifs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-09-18 19:22:22 -05:00
coda
helper for reading ->d_count
2013-07-05 18:59:33 +04:00
configfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-07-14 11:42:26 -07:00
cramfs
[readdir] convert f2fs
2013-06-29 12:56:46 +04:00
debugfs
debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)
2013-07-31 12:16:31 -04:00
devpts
fs: Limit sys_mount to only request filesystem modules (Part 2).
2013-03-07 01:08:55 -08:00
dlm
dlm: remove signal blocking
2013-08-12 15:22:43 -05:00
ecryptfs
ecryptfs: avoid ctx initialization race
2013-09-06 16:58:18 -07:00
efivarfs
efivarfs: we can use simple_lookup() now
2013-07-14 17:48:35 +04:00
efs
efs: iget_locked() doesn't return an ERR_PTR()
2013-08-24 12:10:22 -04:00
exofs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
exportfs
exportfs: don't assume that ->iterate() won't feed us too long entries
2013-09-07 19:54:55 -04:00
ext2
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
ext3
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2013-09-06 09:06:02 -07:00
ext4
Merge branch 'akpm' (patches from Andrew Morton)
2013-09-12 15:44:27 -07:00
f2fs
f2fs: optimize gc for better performance
2013-09-05 13:50:32 +09:00
fat
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
freevxfs
[readdir] convert freevxfs
2013-06-29 12:56:53 +04:00
fscache
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
2013-09-19 12:50:37 -05:00
fuse
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
gfs2
gfs2: set FILE_CREATED
2013-09-16 19:17:24 -04:00
hfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
hfsplus
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
hostfs
um: hostfs: Fix writeback
2013-09-07 10:38:29 +02:00
hpfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
hppfs
clean up scary strncpy(dst, src, strlen(src)) uses
2013-07-03 16:07:41 -07:00
hugetlbfs
cope with potentially long ->d_dname() output for shmem/hugetlb
2013-08-24 12:10:17 -04:00
isofs
isofs: Refuse RW mount of the filesystem instead of making it RO
2013-07-31 22:14:50 +02:00
jbd
jbd: use a single printk for jbd_debug()
2013-08-09 10:49:00 +02:00
jbd2
jbd2: Fix endian mixing problems in the checksumming code
2013-08-28 14:59:58 -04:00
jffs2
[readdir] convert jffs2
2013-06-29 12:56:47 +04:00
jfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
lockd
LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs
2013-08-05 15:03:46 -04:00
logfs
Lots of bug fixes, cleanups and optimizations. In the bug fixes
2013-07-02 09:39:34 -07:00
minix
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
ncpfs
ncpfs: fix error return code in ncp_parse_options()
2013-07-09 10:33:25 -07:00
nfs
NFSv4: fix NULL dereference in open recover
2013-10-28 14:53:32 -04:00
nfs_common
nfs_common: Update the translation between nfsv3 acls linux posix acls
2013-02-13 06:15:14 -08:00
nfsd
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-09-12 15:01:38 -07:00
nilfs2
nilfs2: fix issue with race condition of competition between segments for dirty blocks
2013-09-30 14:31:02 -07:00
nls
…
notify
fsnotify: update comments concerning locking scheme
2013-07-09 10:33:20 -07:00
ntfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
ocfs2
ocfs2: needs ->d_lock to poke in ->d_parent->d_inode from ->d_revalidate()
2013-09-29 22:02:20 -04:00
omfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
openpromfs
[readdir] convert openpromfs
2013-06-29 12:56:32 +04:00
proc
thp: account anon transparent huge pages into NR_ANON_PAGES
2013-09-12 15:38:03 -07:00
pstore
pstore: Remove the messages related to compression failure
2013-09-16 09:28:29 -07:00
qnx4
[readdir] convert qnx4
2013-06-29 12:56:38 +04:00
qnx6
[readdir] convert qnx6
2013-06-29 12:56:39 +04:00
quota
fs: convert fs shrinkers to new scan/count API
2013-09-10 18:56:31 -04:00
ramfs
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
reiserfs
reiserfs: fix race with flush_used_journal_lists and flush_journal_list
2013-09-24 11:24:21 +02:00
romfs
[readdir] convert romfs
2013-06-29 12:56:29 +04:00
squashfs
Squashfs: add corruption check for type in squashfs_readdir()
2013-09-06 04:57:54 +01:00
sysfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-09-07 14:36:57 -07:00
sysv
sysv: Add forgotten superblock lock init for v7 fs
2013-09-29 22:02:02 -04:00
ubifs
Just one patch which fixes the power-cut recovery testing mode.
2013-09-16 15:36:55 -04:00
udf
udf: Fortify LVID loading
2013-09-24 11:23:33 +02:00
ufs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
xfs
xfs: fix node forward in xfs_node_toosmall
2013-09-26 10:38:17 -05:00
aio.c
aio: rcu_read_lock protection for new rcu_dereference calls
2013-09-09 12:29:35 -04:00
anon_inodes.c
fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()
2013-07-16 09:32:17 -04:00
attr.c
…
bad_inode.c
[readdir] ->readdir() is gone
2013-06-29 12:57:04 +04:00
binfmt_aout.c
mm: remove free_area_cache
2013-07-10 18:11:34 -07:00
binfmt_elf_fdpic.c
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
2013-05-02 10:16:16 -07:00
binfmt_elf.c
fs/binfmt_elf.c: prevent a coredump with a large vm_map_count from Oopsing
2013-09-30 14:31:01 -07:00
binfmt_em86.c
…
binfmt_flat.c
new helper: read_code()
2013-04-29 15:40:23 -04:00
binfmt_misc.c
binfmt_misc: reuse string_unescape_inplace()
2013-04-30 17:04:03 -07:00
binfmt_script.c
…
binfmt_som.c
…
bio-integrity.c
Merge branch 'for-3.12/core' of git://git.kernel.dk/linux-block
2013-09-22 15:00:11 -07:00
bio.c
block: Fix bio_copy_data()
2013-09-24 14:41:42 -07:00
block_dev.c
a trivial writeback fix
2013-09-13 23:06:40 -04:00
buffer.c
mm: vmscan: take page buffers dirty and locked state into account
2013-07-03 16:07:29 -07:00
char_dev.c
…
compat_binfmt_elf.c
…
compat_ioctl.c
compat.c: LOOP_CLR_FD is taken care of in loop.c itself...
2013-06-29 12:46:44 +04:00
compat.c
[readdir] constify ->actor
2013-06-29 12:57:05 +04:00
coredump.c
coredump: add new %P variable in core_pattern
2013-09-11 15:59:01 -07:00
coredump.h
…
dcache.c
vfs: fix typo in comment in recent dentry work
2013-09-15 07:11:01 -04:00
dcookies.c
consolidate compat lookup_dcookie()
2013-03-03 23:00:23 -05:00
direct-io.c
direct-io: Use return from cmpxchg to decide of assignment happened
2013-09-09 10:47:42 -07:00
drop_caches.c
shrinker: add node awareness
2013-09-10 18:56:31 -04:00
eventfd.c
…
eventpoll.c
epoll: add a reschedule point in ep_free()
2013-09-11 15:58:50 -07:00
exec.c
exec: cleanup the error handling in search_binary_handler()
2013-09-11 15:59:09 -07:00
fcntl.c
vfs: add missing check for __O_TMPFILE in fcntl_init()
2013-08-05 18:25:32 +04:00
fhandle.c
…
file_table.c
fs/file_table.c:fput(): make comment more truthful
2013-09-11 15:59:01 -07:00
file.c
don't bother with deferred freeing of fdtables
2013-05-01 17:31:42 -04:00
filesystems.c
fs: Limit sys_mount to only request filesystem modules.
2013-03-03 19:36:31 -08:00
fs_struct.c
constify path_get/path_put and fs_struct.c stuff
2013-03-01 23:51:07 -05:00
fs-writeback.c
a trivial writeback fix
2013-09-13 23:06:40 -04:00
generic_acl.c
…
inode.c
fs: convert inode and dentry shrinking to be node aware
2013-09-10 18:56:31 -04:00
internal.h
fs: convert inode and dentry shrinking to be node aware
2013-09-10 18:56:31 -04:00
ioctl.c
new helper: file_inode(file)
2013-02-22 23:31:31 -05:00
ioprio.c
…
Kconfig
efivarfs: Move to fs/efivarfs
2013-04-17 13:25:09 +01:00
Kconfig.binfmt
fs: make binfmt support for #! scripts modular and removable
2013-04-30 17:04:04 -07:00
libfs.c
make simple_lookup() usable for filesystems that set ->s_d_op
2013-07-14 17:43:25 +04:00
locks.c
locks: move file_lock_list to a set of percpu hlist_heads and convert file_lock_lock to an lglock
2013-07-08 13:36:42 +04:00
Makefile
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-05-01 17:51:54 -07:00
mbcache.c
fs: convert fs shrinkers to new scan/count API
2013-09-10 18:56:31 -04:00
mount.h
get rid of full-hash scan on detaching vfsmounts
2013-04-09 14:12:52 -04:00
mpage.c
…
namei.c
atomic_open: take care of EEXIST in no-open case with O_CREAT|O_EXCL in fs/namei.c
2013-09-17 17:08:50 -04:00
namespace.c
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
no-block.c
…
open.c
vfs: improve i_op->atomic_open() documentation
2013-09-16 19:17:24 -04:00
pipe.c
aio: don't include aio.h in sched.h
2013-05-07 20:16:25 -07:00
pnode.c
vfs: Fix invalid ida_remove() call
2013-05-31 15:16:33 -04:00
pnode.h
vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces
2013-08-26 18:42:15 -07:00
posix_acl.c
…
proc_namespace.c
…
read_write.c
aio: Kill aio_rw_vect_retry()
2013-07-30 11:53:12 -04:00
readdir.c
[readdir] constify ->actor
2013-06-29 12:57:05 +04:00
select.c
net: rename include/net/ll_poll.h to include/net/busy_poll.h
2013-07-10 17:08:27 -07:00
seq_file.c
seq_file: add seq_list_*_percpu helpers
2013-07-08 13:36:41 +04:00
signalfd.c
switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE
2013-03-03 22:58:46 -05:00
splice.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-07-03 09:10:19 -07:00
stack.c
…
stat.c
quota: provide interface for readding allocated space into reserved space
2013-08-17 09:32:32 -04:00
statfs.c
…
super.c
super: fix for destroy lrus
2013-09-10 18:56:32 -04:00
sync.c
teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long
2013-03-03 22:46:22 -05:00
timerfd.c
timerfd: Add alarm timers
2013-05-29 12:57:34 -07:00
utimes.c
…
xattr_acl.c
…
xattr.c
…