Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 05:02:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
209aa23083
linux/fs/nfs
History
Artem Savkov 209aa23083 nfs/filelayout: fix NULL pointer dereference in fl_pnfs_update_layout() 
Calling pnfs_put_lset on an IS_ERR pointer results in a NULL pointer
dereference like the one below. At the same time the check of retvalue
of filelayout_check_deviceid() sets lseg to error, but does not free it
before that.

[ 3000.636161] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c
[ 3000.636970] IP: pnfs_put_lseg+0x29/0x100 [nfsv4]
[ 3000.637420] PGD 4f23b067
[ 3000.637421] PUD 4a0f4067
[ 3000.637679] PMD 0
[ 3000.637937]
[ 3000.638287] Oops: 0000 [#1] SMP
[ 3000.638591] Modules linked in: nfs_layout_nfsv41_files nfsv3 nfnetlink_queue nfnetlink_log nfnetlink bluetooth rfkill rpcsec_gss_krb5 nfsv4 nfs fscache binfmt_misc arc4 md4 nls_utf8 cifs ccm dns_resolver rpcrdma ib_isert iscsi_target_mod ib_iser rdma_cm iw_cm libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_ucm ib_uverbs ib_umad ib_cm ib_core nls_koi8_u nls_cp932 ts_kmp nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr virtio_balloon ppdev virtio_rng parport_pc i2c_piix4 parport acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c ata_generic pata_acpi virtio_blk virtio_net cirrus drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops crc32c_intel ata_piix ttm libata drm serio_raw
[ 3000.645245]  i2c_core virtio_pci virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: xt_u32]
[ 3000.646360] CPU: 1 PID: 26402 Comm: date Not tainted 4.11.0-rc7.1.el7.test.x86_64 #1
[ 3000.647092] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[ 3000.647638] task: ffff8800415ada00 task.stack: ffffc90000ff0000
[ 3000.648207] RIP: 0010:pnfs_put_lseg+0x29/0x100 [nfsv4]
[ 3000.648696] RSP: 0018:ffffc90000ff39b8 EFLAGS: 00010246
[ 3000.649193] RAX: 0000000000000000 RBX: fffffffffffffff4 RCX: 00000000000d43be
[ 3000.649859] RDX: 00000000000d43bd RSI: 0000000000000000 RDI: fffffffffffffff4
[ 3000.650530] RBP: ffffc90000ff39d8 R08: 000000000001e320 R09: ffffffffa05c35ce
[ 3000.651203] R10: ffff88007fd1e320 R11: ffffea0001283d80 R12: 0000000001400040
[ 3000.651875] R13: ffff88004f77d9f0 R14: ffffc90000ff3cd8 R15: ffff8800417ade00
[ 3000.652546] FS:  00007fac4d5cd740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
[ 3000.653304] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3000.653849] CR2: 000000000000003c CR3: 000000004f080000 CR4: 00000000000406e0
[ 3000.654527] Call Trace:
[ 3000.654771]  fl_pnfs_update_layout.constprop.20+0x10c/0x150 [nfs_layout_nfsv41_files]
[ 3000.655505]  filelayout_pg_init_write+0x21d/0x270 [nfs_layout_nfsv41_files]
[ 3000.656195]  __nfs_pageio_add_request+0x11c/0x490 [nfs]
[ 3000.656698]  nfs_pageio_add_request+0xac/0x260 [nfs]
[ 3000.657180]  nfs_do_writepage+0x109/0x2e0 [nfs]
[ 3000.657616]  nfs_writepages_callback+0x16/0x30 [nfs]
[ 3000.658096]  write_cache_pages+0x26f/0x510
[ 3000.658495]  ? nfs_do_writepage+0x2e0/0x2e0 [nfs]
[ 3000.658946]  ? _raw_spin_unlock_bh+0x1e/0x20
[ 3000.659357]  ? wb_wakeup_delayed+0x5f/0x70
[ 3000.659748]  ? __mark_inode_dirty+0x2eb/0x360
[ 3000.660170]  nfs_writepages+0x84/0xd0 [nfs]
[ 3000.660575]  ? nfs_updatepage+0x571/0xb70 [nfs]
[ 3000.661012]  do_writepages+0x1e/0x30
[ 3000.661358]  __filemap_fdatawrite_range+0xc6/0x100
[ 3000.661819]  filemap_write_and_wait_range+0x41/0x90
[ 3000.662292]  nfs_file_fsync+0x34/0x1f0 [nfs]
[ 3000.662704]  vfs_fsync_range+0x3d/0xb0
[ 3000.663065]  vfs_fsync+0x1c/0x20
[ 3000.663385]  nfs4_file_flush+0x57/0x80 [nfsv4]
[ 3000.663813]  filp_close+0x2f/0x70
[ 3000.664132]  __close_fd+0x9a/0xc0
[ 3000.664453]  SyS_close+0x23/0x50
[ 3000.664785]  do_syscall_64+0x67/0x180
[ 3000.665162]  entry_SYSCALL64_slow_path+0x25/0x25
[ 3000.665600] RIP: 0033:0x7fac4d0e1e90
[ 3000.665946] RSP: 002b:00007ffd54e90c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 3000.666679] RAX: ffffffffffffffda RBX: 00007fac4d3b5400 RCX: 00007fac4d0e1e90
[ 3000.667349] RDX: 0000000000000000 RSI: 00007fac4d5d9000 RDI: 0000000000000001
[ 3000.668031] RBP: 0000000000000000 R08: 00007fac4d3b6a00 R09: 00007fac4d5cd740
[ 3000.668709] R10: 00007ffd54e909e0 R11: 0000000000000246 R12: 0000000000000000
[ 3000.669385] R13: 00007fac4d3b5e80 R14: 0000000000000000 R15: 0000000000000000
[ 3000.670061] Code: 00 00 66 66 66 66 90 55 48 85 ff 48 89 e5 41 56 41 55 41 54 53 48 89 fb 0f 84 97 00 00 00 f6 05 16 8f bc ff 10 0f 85 a6 00 00 00 <4c> 8b 63 48 48 8d 7b 38 49 8b 84 24 90 00 00 00 4c 8d a8 88 00
[ 3000.671831] RIP: pnfs_put_lseg+0x29/0x100 [nfsv4] RSP: ffffc90000ff39b8
[ 3000.672462] CR2: 000000000000003c

Signed-off-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2017-04-28 13:06:59 -04:00
..
blocklayout lib/vsprintf.c: remove %Z support 2017-02-27 18:43:47 -08:00
filelayout nfs/filelayout: fix NULL pointer dereference in fl_pnfs_update_layout() 2017-04-28 13:06:59 -04:00
flexfilelayout pNFS: Ensure we check layout segment validity in the pg_init() callback 2017-04-25 10:56:19 -04:00
cache_lib.c sunrpc/nfs: cleanup procfs/pipefs entry in cache_detail 2017-02-08 17:02:45 -05:00
cache_lib.h
callback_proc.c NFS: Remove extra dprintk()s from callback_proc.c 2017-04-20 13:39:32 -04:00
callback_xdr.c NFS: Remove extra dprintk()s from callback_xdr.c 2017-04-20 13:39:33 -04:00
callback.c NFS client fixes for 4.11 2017-03-17 14:16:22 -07:00
callback.h nfs: add handling for CB_NOTIFY_LOCK in client 2016-09-22 13:56:04 -04:00
client.c lockd: Introduce nlmclnt_operations 2017-04-21 10:45:01 -04:00
delegation.c NFSv4: Optimise away forced revalidation when we know the attributes are OK 2016-12-01 17:21:37 -05:00
delegation.h NFSv4: nfs_inode_find_state_and_recover() should check all stateids 2016-09-27 14:34:35 -04:00
dir.c NFS: switch back to to ->iterate() 2017-04-20 13:33:09 -04:00
direct.c NFS: Clean up nfs_direct_commit_complete() 2017-04-20 13:39:33 -04:00
dns_resolve.c
dns_resolve.h
file.c NFSv4: Don't special case "launder" 2017-04-26 13:03:04 -04:00
fscache-index.c
fscache.c nfs: define nfs_inc_fscache_stats and using it as possible 2014-11-24 20:08:47 -05:00
fscache.h
getroot.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
inode.c Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-03-03 11:38:56 -08:00
internal.h NFS: Add a few more fatal I/O errors to nfs_error_is_fatal() 2017-04-26 13:03:04 -04:00
io.c NFS: Do not serialise O_DIRECT reads and writes 2016-07-05 19:11:04 -04:00
iostat.h nfs: define nfs_inc_fscache_stats and using it as possible 2014-11-24 20:08:47 -05:00
Kconfig nfs: remove the objlayout driver 2017-04-20 15:51:23 -04:00
Makefile nfs: remove the objlayout driver 2017-04-20 15:51:23 -04:00
mount_clnt.c NFS: Remove unneeded NFS_DEBUG checking before define NFSDBG_FACILITY 2015-10-21 15:49:23 -05:00
namespace.c NFS: Remove extra dprintk()s from namespace.c 2017-04-20 13:39:34 -04:00
netns.h netns: make struct pernet_operations::id unsigned int 2016-11-18 10:59:15 -05:00
nfs2super.c
nfs2xdr.c nfs: save server READ/WRITE/COMMIT status 2015-02-03 11:06:40 -08:00
nfs3_fs.h nfsv3: introduce nfs3_set_ds_client 2015-02-03 11:06:34 -08:00
nfs3acl.c posix_acl: Inode acl caching fixes 2016-03-31 00:30:15 -04:00
nfs3client.c NFS: Remove unused authflavour parameter from nfs_get_client() 2016-12-01 17:46:32 -05:00
nfs3proc.c NFSv3: nfs3_nlm_alloc_call should be declared static 2017-04-25 16:25:06 -04:00
nfs3super.c nfsv3: introduce nfs3_set_ds_client 2015-02-03 11:06:34 -08:00
nfs3xdr.c xprtrdma: Fix large NFS SYMLINK calls 2015-08-05 16:21:28 -04:00
nfs4_fs.h NFS: Use nfs4_setup_sequence() everywhere 2017-01-30 13:14:50 -05:00
nfs4client.c NFS: Remove extra dprintk()s from nfs4client.c 2017-04-20 13:39:35 -04:00
nfs4file.c NFSv4: add flock_owner to open context 2016-12-01 17:57:27 -05:00
nfs4getroot.c NFS: Clean up nfs4_get_rootfh() 2017-04-20 13:39:35 -04:00
nfs4idmap.c KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload() 2017-03-02 10:09:00 +11:00
nfs4idmap.h NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4namespace.c NFS: Remove extra dprintk()s from nfs4namespace.c 2017-04-20 13:39:35 -04:00
nfs4proc.c NFS: Always wait for I/O completion before unlock 2017-04-21 10:45:01 -04:00
nfs4renewd.c NFSv4: Set the connection timeout to match the lease period 2017-02-09 14:15:16 -05:00
nfs4session.c NFSv4.1: Fix regression in callback retry handling 2016-12-01 17:21:38 -05:00
nfs4session.h NFS: Make trace_nfs4_setup_sequence() available to NFS v4.0 2017-01-30 13:14:50 -05:00
nfs4state.c NFSv4: Fix warning for using 0 as NULL 2017-01-30 13:14:51 -05:00
nfs4super.c NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4sysctl.c nfs: do not initialise statics to 0 2015-12-28 09:57:15 -05:00
nfs4trace.c pNFS: Modify pnfs_update_layout tracepoints to use layout stateid 2015-12-28 09:57:14 -05:00
nfs4trace.h NFS: Make trace_nfs4_setup_sequence() available to NFS v4.0 2017-01-30 13:14:50 -05:00
nfs4xdr.c pNFS: Remove unused layout driver callbacks 2017-04-20 16:48:14 -04:00
nfs42.h NFS: Add COPY nfs operation 2016-05-17 15:47:55 -04:00
nfs42proc.c NFS: Clean up nfs42_layoutstat_done() 2017-04-20 13:39:34 -04:00
nfs42xdr.c pNFS/flexfiles: Minor refactoring before adding iostats to layoutreturn 2016-12-03 15:37:45 -05:00
nfs.h
nfsroot.c nfsroot: make nfsroot to accept the 1024 bytes long directory name 2015-10-21 15:49:19 -05:00
nfstrace.c NFSv4: Allow tracing of NFSv4 fsync calls 2015-03-27 12:39:34 -04:00
nfstrace.h NFS client updates for Linux 4.8 2016-07-30 16:33:25 -07:00
pagelist.c NFS: Add an iocounter wait function for async RPC tasks 2017-04-21 10:45:01 -04:00
pnfs_dev.c NFSv4.1: Don't cache deviceids that have no notifications 2015-03-27 12:32:24 -04:00
pnfs_nfs.c pNFS: unexport nfs4_pnfs_v3_ds_connect_unload 2017-04-20 16:58:50 -04:00
pnfs.c pNFS: Fix use after free issues in pnfs_do_read() 2017-04-25 15:42:34 -04:00
pnfs.h pNFS: Ensure we check layout segment validity in the pg_init() callback 2017-04-25 10:56:19 -04:00
proc.c lockd: Introduce nlmclnt_operations 2017-04-21 10:45:01 -04:00
read.c NFS: move rw_mode to nfs_pageio_header 2017-04-20 14:00:41 -04:00
super.c NFS: tidy up nfs_show_mountd_netid 2017-01-30 13:14:50 -05:00
symlink.c vfs: remove ".readlink = generic_readlink" assignments 2016-12-09 16:45:04 +01:00
sysctl.c
unlink.c qstr: constify instances in nfs 2016-07-20 23:30:06 -04:00
write.c NFSv4: Don't special case "launder" 2017-04-26 13:03:04 -04:00