From patchwork Thu Dec 13 01:13:41 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 1871131 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 24E593FC71 for ; Thu, 13 Dec 2012 01:13:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755200Ab2LMBNx (ORCPT ); Wed, 12 Dec 2012 20:13:53 -0500 Received: from cantor2.suse.de ([195.135.220.15]:35649 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755130Ab2LMBNw (ORCPT ); Wed, 12 Dec 2012 20:13:52 -0500 Received: from relay2.suse.de (unknown [195.135.220.254]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx2.suse.de (Postfix) with ESMTP id 0F4CDA4F01; Thu, 13 Dec 2012 02:13:51 +0100 (CET) Date: Thu, 13 Dec 2012 12:13:41 +1100 From: NeilBrown To: "Myklebust, Trond" Cc: NFS Subject: Re: NULL dereference from nfs_destroy_server, with possible fix. Message-ID: <20121213121341.59a17609@notabene.brown> In-Reply-To: <4FA345DA4F4AE44899BD2B03EEEC2FA91192944F@SACEXCMBX04-PRD.hq.netapp.com> References: <20121213110528.0a04e399@notabene.brown> <4FA345DA4F4AE44899BD2B03EEEC2FA91192944F@SACEXCMBX04-PRD.hq.netapp.com> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-suse-linux-gnu) Mime-Version: 1.0 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org On Thu, 13 Dec 2012 01:05:15 +0000 "Myklebust, Trond" wrote: > On Thu, 2012-12-13 at 11:05 +1100, NeilBrown wrote: > > Hi, > > > > I recently managed to get the following stack trace, though I haven't been > > able to reproduce it. > > > > Dec 12 17:17:04 hp kernel: [22684.894434] BUG: unable to handle kernel NULL pointer dereference at 0000000000000310 > > Dec 12 17:17:04 hp kernel: [22684.894490] IP: [] nlmclnt_done+0x9/0x30 > > Dec 12 17:17:04 hp kernel: [22684.894529] PGD 13cc5a067 PUD 13ca0a067 PMD 0 > > Dec 12 17:17:04 hp kernel: [22684.894593] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC > > Dec 12 17:17:04 hp kernel: [22684.894660] Modules linked in: > > Dec 12 17:17:04 hp kernel: [22684.894691] CPU 0 > > Dec 12 17:17:04 hp kernel: [22684.894708] Pid: 6874, comm: ls Not tainted 3.7.0-rc1+ #323 HP ProLiant ML310 G3 > > Dec 12 17:17:04 hp kernel: [22684.894745] RIP: 0010:[] [] nlmclnt_done+0x9/0x30 > > Dec 12 17:17:04 hp kernel: [22684.894783] RSP: 0018:ffff880139d59958 EFLAGS: 00010292 > > Dec 12 17:17:04 hp kernel: [22684.894804] RAX: 0000000000000000 RBX: ffff88013760e7f0 RCX: 0000000000000000 > > Dec 12 17:17:04 hp kernel: [22684.894829] RDX: 0000000000000046 RSI: 0000000000000001 RDI: 0000000000000000 > > Dec 12 17:17:04 hp kernel: [22684.894852] RBP: ffff880139d59968 R08: 0000000000000000 R09: 0000000000000000 > > Dec 12 17:17:04 hp kernel: [22684.894878] R10: 0000000000000001 R11: 0000000000000000 R12: dead000000200200 > > Dec 12 17:17:04 hp kernel: [22684.894900] R13: ffff88013bdfaed0 R14: dead000000200200 R15: ffff880139fde7f0 > > Dec 12 17:17:04 hp kernel: [22684.894924] FS: 00007f279bbf57c0(0000) GS:ffff880147c00000(0000) knlGS:0000000000000000 > > Dec 12 17:17:04 hp kernel: [22684.894947] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > > Dec 12 17:17:04 hp kernel: [22684.894968] CR2: 0000000000000310 CR3: 0000000137ea1000 CR4: 00000000000007f0 > > Dec 12 17:17:04 hp kernel: [22684.894995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > Dec 12 17:17:04 hp kernel: [22684.895017] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > > Dec 12 17:17:04 hp kernel: [22684.895039] Process ls (pid: 6874, threadinfo ffff880139d58000, task ffff88013bbdc050) > > Dec 12 17:17:04 hp kernel: [22684.895061] Stack: > > Dec 12 17:17:04 hp kernel: [22684.895079] ffff880139d59978 ffff88013760e7f0 ffff880139d59978 ffffffff812c41ff > > Dec 12 17:17:04 hp kernel: [22684.895148] ffff880139d599b8 ffffffff812c4eab ffffffff812c4d9b ffff88013760e7f0 > > Dec 12 17:17:04 hp kernel: [22684.895220] ffff88013760e7f0 ffffffffffffff8c ffff88013e3a7ef0 00000000ffffff8c > > Dec 12 17:17:04 hp kernel: [22684.895287] Call Trace: > > Dec 12 17:17:04 hp kernel: [22684.895312] [] nfs_destroy_server+0x1f/0x30 > > Dec 12 17:17:04 hp kernel: [22684.895337] [] nfs_free_server+0x13b/0x200 > > Dec 12 17:17:04 hp kernel: [22684.895362] [] ? nfs_free_server+0x2b/0x200 > > Dec 12 17:17:04 hp kernel: [22684.895386] [] nfs_clone_server+0x1ab/0x250 > > Dec 12 17:17:04 hp kernel: [22684.895411] [] nfs3_clone_server+0x18/0x50 > > Dec 12 17:17:04 hp kernel: [22684.895437] [] nfs_xdev_mount+0x82/0x120 > > Dec 12 17:17:04 hp kernel: [22684.895462] [] ? nfs_set_super+0x60/0x60 > > Dec 12 17:17:04 hp kernel: [22684.895486] [] ? nfs_set_sb_security+0x10/0x10 > > Dec 12 17:17:04 hp kernel: [22684.895512] [] mount_fs+0x1b/0xd0 > > Dec 12 17:17:04 hp kernel: [22684.895545] [] vfs_kern_mount+0x6f/0x110 > > Dec 12 17:17:04 hp kernel: [22684.895569] [] nfs_do_submount+0xa2/0x150 > > Dec 12 17:17:04 hp kernel: [22684.895593] [] nfs_submount+0x7e/0xa0 > > Dec 12 17:17:04 hp kernel: [22684.895617] [] nfs_d_automount+0xcc/0x1c0 > > Dec 12 17:17:04 hp kernel: [22684.895643] [] follow_managed+0x150/0x310 > > Dec 12 17:17:04 hp kernel: [22684.895668] [] lookup_fast+0x1c1/0x310 > > Dec 12 17:17:04 hp kernel: [22684.895693] [] do_last.isra.57+0x17c/0xc50 > > Dec 12 17:17:04 hp kernel: [22684.895717] [] ? inode_permission+0x13/0x50 > > Dec 12 17:17:04 hp kernel: [22684.895741] [] ? link_path_walk+0x22d/0x8f0 > > Dec 12 17:17:04 hp kernel: [22684.895766] [] path_openat.isra.58+0xb3/0x4c0 > > Dec 12 17:17:04 hp kernel: [22684.895791] [] ? getname_flags+0x2b/0x110 > > Dec 12 17:17:04 hp kernel: [22684.895816] [] ? __alloc_fd+0x2f/0x130 > > Dec 12 17:17:04 hp kernel: [22684.895842] [] do_filp_open+0x3c/0x90 > > Dec 12 17:17:04 hp kernel: [22684.895866] [] ? __alloc_fd+0xd9/0x130 > > Dec 12 17:17:04 hp kernel: [22684.895891] [] do_sys_open+0xef/0x1d0 > > > > > > The problem is that nfs_destroy_server is calling nlmclnt_done(NULL). > > This can happen if nfs_clone_server() is called on a v2/v3 mount but gets an > > error between > > > > server->destroy = source->destroy; > > > > (which sets server->destroy to nfs_destroy_dever without setting > > server->nlm_host) and > > > > error = nfs_start_lockd(server); > > > > (which sets both server->destroy and server->nlm_host). > > > > If this happens then nfs_free_server() calls ->destroy() which crashes as > > shown. > > > > Maybe this patch? > > > > Signed-off-by: NeilBrown > > diff --git a/fs/nfs/client.c b/fs/nfs/client.c > > index 8b39a42..b6603bb 100644 > > --- a/fs/nfs/client.c > > +++ b/fs/nfs/client.c > > @@ -617,7 +617,8 @@ static void nfs_destroy_server(struct nfs_server *server) > > { > > if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || > > !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) > > - nlmclnt_done(server->nlm_host); > > + if (server->nlm_host) > > + nlmclnt_done(server->nlm_host); > > } > > Hmm... Do we need all those tests of server->flags above if we can just > check server->nlm_host for a NULL value? > No, you are right. nlm_host will only be non-NULL if the one of the flags is set, so the test is pointless. NeilBrown diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 8b39a42..5e8d24d 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -615,8 +615,7 @@ EXPORT_SYMBOL_GPL(nfs_create_rpc_client); */ static void nfs_destroy_server(struct nfs_server *server) { - if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) || - !(server->flags & NFS_MOUNT_LOCAL_FCNTL)) + if (server->nlm_host) nlmclnt_done(server->nlm_host); }