q3k/linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
linux/net/sunrpc
History
Cedric Le Goater 63ffc23d30 sunrpc: fix oops in rpc_create when the mount namespace is unshared 
On a system with nfs mounts, if a task unshares its mount namespace,
a oops can occur when the system is rebooted if the task is the last
to unreference the nfs mount. It will try to create a rpc request
using utsname() which has been invalidated by free_nsproxy().

The patch fixes the issue by using the global init_utsname() which is
always valid. the capability of identifying rpc clients per uts namespace
stills needs some extra work so this should not be a problem.

BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<c024c9ab>] rpc_create+0x332/0x42f
Oops: 0000 [#1] DEBUG_PAGEALLOC

Pid: 1857, comm: uts-oops Not tainted (2.6.27-rc5-00319-g7686ad5 #4)
EIP: 0060:[<c024c9ab>] EFLAGS: 00210287 CPU: 0
EIP is at rpc_create+0x332/0x42f
EAX: 00000000 EBX: df26adf0 ECX: c0251887 EDX: 00000001
ESI: df26ae58 EDI: c02f293c EBP: dda0fc9c ESP: dda0fc2c
 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Process uts-oops (pid: 1857, ti=dda0e000 task=dd9a0778 task.ti=dda0e000)
Stack: c0104532 dda0fffc dda0fcac dda0e000 dda0e000 dd93b7f0 00000009 c02f2880
       df26aefc dda0fc68 c01096b7 00000000 c0266ee0 c039a070 c039a070 dda0fc74
       c012ca67 c039a064 dda0fc8c c012cb20 c03daf74 00000011 00000000 c0275c90
Call Trace:
 [<c0104532>] ? dump_trace+0xc2/0xe2
 [<c01096b7>] ? save_stack_trace+0x1c/0x3a
 [<c012ca67>] ? save_trace+0x37/0x8c
 [<c012cb20>] ? add_lock_to_list+0x64/0x96
 [<c0256fc4>] ? rpcb_register_call+0x62/0xbb
 [<c02570c8>] ? rpcb_register+0xab/0xb3
 [<c0252f4d>] ? svc_register+0xb4/0x128
 [<c0253114>] ? svc_destroy+0xec/0x103
 [<c02531b2>] ? svc_exit_thread+0x87/0x8d
 [<c01a75cd>] ? lockd_down+0x61/0x81
 [<c01a577b>] ? nlmclnt_done+0xd/0xf
 [<c01941fe>] ? nfs_destroy_server+0x14/0x16
 [<c0194328>] ? nfs_free_server+0x4c/0xaa
 [<c019a066>] ? nfs_kill_super+0x23/0x27
 [<c0158585>] ? deactivate_super+0x3f/0x51
 [<c01695d1>] ? mntput_no_expire+0x95/0xb4
 [<c016965b>] ? release_mounts+0x6b/0x7a
 [<c01696cc>] ? __put_mnt_ns+0x62/0x70
 [<c0127501>] ? free_nsproxy+0x25/0x80
 [<c012759a>] ? switch_task_namespaces+0x3e/0x43
 [<c01275a9>] ? exit_task_namespaces+0xa/0xc
 [<c0117fed>] ? do_exit+0x4fd/0x666
 [<c01181b3>] ? do_group_exit+0x5d/0x83
 [<c011fa8c>] ? get_signal_to_deliver+0x2c8/0x2e0
 [<c0102630>] ? do_notify_resume+0x69/0x700
 [<c011d85a>] ? do_sigaction+0x134/0x145
 [<c0127205>] ? hrtimer_nanosleep+0x8f/0xce
 [<c0126d1a>] ? hrtimer_wakeup+0x0/0x1c
 [<c0103488>] ? work_notifysig+0x13/0x1b
 =======================
Code: 70 20 68 cb c1 2c c0 e8 75 4e 01 00 8b 83 ac 00 00 00 59 3d 00 f0 ff ff 5f 77 63 eb 57 a1 00 80 2d c0 8b 80 a8 02 00 00 8d 73 68 <8b> 40 04 83 c0 45 e8 41 46 f7 ff ba 20 00 00 00 83 f8 21 0f 4c
EIP: [<c024c9ab>] rpc_create+0x332/0x42f SS:ESP 0068:dda0fc2c

Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>
Cc: Chuck Lever <chuck.lever@oracle.com>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2008-10-07 18:19:10 -04:00
..
auth_gss Merge branch 'for-2.6.27' of git://linux-nfs.org/~bfields/linux 2008-07-20 21:21:46 -07:00
xprtrdma svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet 2008-08-13 16:57:31 -04:00
auth.c SUNRPC: Protect creds against early garbage collection 2008-04-19 16:55:02 -04:00
auth_generic.c SUNRPC: AUTH_SYS "machine creds" shouldn't use negative valued uid/gid 2008-05-18 14:18:27 -04:00
auth_null.c NFSv4: Don't use cred->cr_ops->cr_name in nfs4_proc_setclientid() 2008-04-19 16:54:53 -04:00
auth_unix.c SUNRPC: Use GFP_NOFS when allocating credentials 2008-07-09 12:08:48 -04:00
cache.c sunrpc: assign PDE->data before gluing PDE into /proc tree 2008-05-02 02:44:36 -07:00
clnt.c sunrpc: fix oops in rpc_create when the mount namespace is unshared 2008-10-07 18:19:10 -04:00
Makefile SUNRPC: Add a generic RPC credential 2008-03-14 13:42:38 -04:00
rpc_pipe.c SL*B: drop kmem cache argument from constructor 2008-07-26 12:00:07 -07:00
rpcb_clnt.c SUNRPC: Fix a memory leak in rpcb_getport_async 2008-10-07 18:18:57 -04:00
sched.c SUNRPC: Remove the BKL from the callback functions 2008-07-15 18:10:57 -04:00
socklib.c SUNRPC: temp var should match return type of xdr_skb_read_actor 2008-01-30 02:05:43 -05:00
stats.c sunrpc: assign PDE->data before gluing PDE into /proc tree 2008-05-02 02:44:36 -07:00
sunrpc_syms.c SUNRPC: Move exported symbol definitions after function declaration part 2 2008-02-01 17:01:24 -05:00
svc.c cpumask: change cpumask_of_cpu_ptr to use new cpumask_of_cpu 2008-07-26 16:40:33 +02:00
svc_xprt.c svc: Remove unused header files from svc_xprt.c 2008-05-19 07:33:42 -05:00
svcauth.c SUNRPC: Move exported symbol definitions after function declaration part 2 2008-02-01 17:01:24 -05:00
svcauth_unix.c svcrpc: fix proc/net/rpc/auth.unix.ip/content display 2008-05-18 19:13:07 -04:00
svcsock.c SUNRPC: Update RPC server's TCP record marker decoder 2008-04-23 16:13:43 -04:00
sysctl.c sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports 2008-09-01 14:24:24 -04:00
timer.c SUNRPC: add EXPORT_SYMBOL_GPL for generic transport functions 2007-10-09 17:17:36 -04:00
xdr.c SUNRPC: don't call flush_dcache_page() with an invalid pointer 2008-04-08 21:06:50 -04:00
xprt.c sunrpc: do not pin sunrpc module in the memory 2008-10-07 18:14:54 -04:00
xprtsock.c SUNRPC: Ensure all transports set rq_xtime consistently 2008-07-09 12:09:15 -04:00