From patchwork Thu Dec 13 00:05:28 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 1871011 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 23644DF266 for ; Thu, 13 Dec 2012 00:05:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754876Ab2LMAFm (ORCPT ); Wed, 12 Dec 2012 19:05:42 -0500 Received: from cantor2.suse.de ([195.135.220.15]:33925 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754276Ab2LMAFm (ORCPT ); Wed, 12 Dec 2012 19:05:42 -0500 Received: from relay1.suse.de (unknown [195.135.220.254]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx2.suse.de (Postfix) with ESMTP id 62833A341E; Thu, 13 Dec 2012 01:05:40 +0100 (CET) Date: Thu, 13 Dec 2012 11:05:28 +1100 From: NeilBrown To: "Myklebust, Trond" Cc: NFS Subject: NULL dereference from nfs_destroy_server, with possible fix. Message-ID: <20121213110528.0a04e399@notabene.brown> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-suse-linux-gnu) Mime-Version: 1.0 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org Hi, I recently managed to get the following stack trace, though I haven't been able to reproduce it. Dec 12 17:17:04 hp kernel: [22684.894434] BUG: unable to handle kernel NULL pointer dereference at 0000000000000310 Dec 12 17:17:04 hp kernel: [22684.894490] IP: [] nlmclnt_done+0x9/0x30 Dec 12 17:17:04 hp kernel: [22684.894529] PGD 13cc5a067 PUD 13ca0a067 PMD 0 Dec 12 17:17:04 hp kernel: [22684.894593] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC Dec 12 17:17:04 hp kernel: [22684.894660] Modules linked in: Dec 12 17:17:04 hp kernel: [22684.894691] CPU 0 Dec 12 17:17:04 hp kernel: [22684.894708] Pid: 6874, comm: ls Not tainted 3.7.0-rc1+ #323 HP ProLiant ML310 G3 Dec 12 17:17:04 hp kernel: [22684.894745] RIP: 0010:[] [] nlmclnt_done+0x9/0x30 Dec 12 17:17:04 hp kernel: [22684.894783] RSP: 0018:ffff880139d59958 EFLAGS: 00010292 Dec 12 17:17:04 hp kernel: [22684.894804] RAX: 0000000000000000 RBX: ffff88013760e7f0 RCX: 0000000000000000 Dec 12 17:17:04 hp kernel: [22684.894829] RDX: 0000000000000046 RSI: 0000000000000001 RDI: 0000000000000000 Dec 12 17:17:04 hp kernel: [22684.894852] RBP: ffff880139d59968 R08: 0000000000000000 R09: 0000000000000000 Dec 12 17:17:04 hp kernel: [22684.894878] R10: 0000000000000001 R11: 0000000000000000 R12: dead000000200200 Dec 12 17:17:04 hp kernel: [22684.894900] R13: ffff88013bdfaed0 R14: dead000000200200 R15: ffff880139fde7f0 Dec 12 17:17:04 hp kernel: [22684.894924] FS: 00007f279bbf57c0(0000) GS:ffff880147c00000(0000) knlGS:0000000000000000 Dec 12 17:17:04 hp kernel: [22684.894947] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b Dec 12 17:17:04 hp kernel: [22684.894968] CR2: 0000000000000310 CR3: 0000000137ea1000 CR4: 00000000000007f0 Dec 12 17:17:04 hp kernel: [22684.894995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Dec 12 17:17:04 hp kernel: [22684.895017] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Dec 12 17:17:04 hp kernel: [22684.895039] Process ls (pid: 6874, threadinfo ffff880139d58000, task ffff88013bbdc050) Dec 12 17:17:04 hp kernel: [22684.895061] Stack: Dec 12 17:17:04 hp kernel: [22684.895079] ffff880139d59978 ffff88013760e7f0 ffff880139d59978 ffffffff812c41ff Dec 12 17:17:04 hp kernel: [22684.895148] ffff880139d599b8 ffffffff812c4eab ffffffff812c4d9b ffff88013760e7f0 Dec 12 17:17:04 hp kernel: [22684.895220] ffff88013760e7f0 ffffffffffffff8c ffff88013e3a7ef0 00000000ffffff8c Dec 12 17:17:04 hp kernel: [22684.895287] Call Trace: Dec 12 17:17:04 hp kernel: [22684.895312] [] nfs_destroy_server+0x1f/0x30 Dec 12 17:17:04 hp kernel: [22684.895337] [] nfs_free_server+0x13b/0x200 Dec 12 17:17:04 hp kernel: [22684.895362] [] ? nfs_free_server+0x2b/0x200 Dec 12 17:17:04 hp kernel: [22684.895386] [] nfs_clone_server+0x1ab/0x250 Dec 12 17:17:04 hp kernel: [22684.895411] [] nfs3_clone_server+0x18/0x50 Dec 12 17:17:04 hp kernel: [22684.895437] [] nfs_xdev_mount+0x82/0x120 Dec 12 17:17:04 hp kernel: [22684.895462] [] ? nfs_set_super+0x60/0x60 Dec 12 17:17:04 hp kernel: [22684.895486] [] ? nfs_set_sb_security+0x10/0x10 Dec 12 17:17:04 hp kernel: [22684.895512] [] mount_fs+0x1b/0xd0 Dec 12 17:17:04 hp kernel: [22684.895545] [] vfs_kern_mount+0x6f/0x110 Dec 12 17:17:04 hp kernel: [22684.895569] [] nfs_do_submount+0xa2/0x150 Dec 12 17:17:04 hp kernel: [22684.895593] [] nfs_submount+0x7e/0xa0 Dec 12 17:17:04 hp kernel: [22684.895617] [] nfs_d_automount+0xcc/0x1c0 Dec 12 17:17:04 hp kernel: [22684.895643] [] follow_managed+0x150/0x310 Dec 12 17:17:04 hp kernel: [22684.895668] [] lookup_fast+0x1c1/0x310 Dec 12 17:17:04 hp kernel: [22684.895693] [] do_last.isra.57+0x17c/0xc50 Dec 12 17:17:04 hp kernel: [22684.895717] [] ? inode_permission+0x13/0x50 Dec 12 17:17:04 hp kernel: [22684.895741] [] ? link_path_walk+0x22d/0x8f0 Dec 12 17:17:04 hp kernel: [22684.895766] [] path_openat.isra.58+0xb3/0x4c0 Dec 12 17:17:04 hp kernel: [22684.895791] [] ? getname_flags+0x2b/0x110 Dec 12 17:17:04 hp kernel: [22684.895816] [] ? __alloc_fd+0x2f/0x130 Dec 12 17:17:04 hp kernel: [22684.895842] [] do_filp_open+0x3c/0x90 Dec 12 17:17:04 hp kernel: [22684.895866] [] ? __alloc_fd+0xd9/0x130 Dec 12 17:17:04 hp kernel: [22684.895891] [] do_sys_open+0xef/0x1d0 The problem is that nfs_destroy_server is calling nlmclnt_done(NULL). This can happen if nfs_clone_server() is called on a v2/v3 mount but gets an error between server->destroy = source->destroy; (which sets server->destroy to nfs_destroy_dever without setting server->nlm_host) and error = nfs_start_lockd(server); (which sets both server->destroy and server->nlm_host). If this happens then nfs_free_server() calls ->destroy() which crashes as shown. Maybe this patch? Signed-off-by: NeilBrown Thanks, NeilBrown diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 8b39a42..b6603bb 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -617,7 +617,8 @@ static void nfs_destroy_server(struct nfs_server *server) { if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) - nlmclnt_done(server->nlm_host); + if (server->nlm_host) + nlmclnt_done(server->nlm_host); } /*