From: "J. Bruce Fields" <bfields@fieldses.org>
To: Sasha Levin <levinsasha928@gmail.com>
Cc: linux-kernel@vger.kernel.org, Neil Brown <neilb@suse.de>,
linux-nfs@vger.kernel.org
Subject: Re: [PATCH] nfsd: Fix oops when parsing a 0 length export
Date: Tue, 22 Nov 2011 15:28:17 -0500 [thread overview]
Message-ID: <20111122202817.GD21451@fieldses.org> (raw)
In-Reply-To: <1321611289-21809-1-git-send-email-levinsasha928@gmail.com>
On Fri, Nov 18, 2011 at 12:14:49PM +0200, Sasha Levin wrote:
> expkey_parse() oopses when handling a 0 length export. This is easily
> triggerable from usermode by writing 0 bytes into
> '/proc/[proc id]/net/rpc/nfsd.fh/channel'.
Thanks--how did you run across this?
--b.
>
> Below is the log:
>
> [ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff
> [ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
> [ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160
> [ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> [ 1402.287632] CPU 1
> [ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6
> [ 1402.287632] RIP: 0010:[<ffffffff812b4b99>] [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
> [ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292
> [ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400
> [ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0
> [ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000
> [ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000
> [ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0
> [ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
> [ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0
> [ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0)
> [ 1402.287632] Stack:
> [ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e
> [ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0
> [ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63
> [ 1402.287632] Call Trace:
> [ 1402.287632] [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc
> [ 1402.287632] [<ffffffff81111f63>] ? might_fault+0x97/0x9e
> [ 1402.287632] [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e
> [ 1402.287632] [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f
> [ 1402.287632] [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130
> [ 1402.287632] [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a
> [ 1402.287632] [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b
> [ 1402.287632] [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad
> [ 1402.287632] [<ffffffff8113fe81>] vfs_write+0xaa/0xfd
> [ 1402.287632] [<ffffffff8114142d>] ? fget_light+0x35/0x9e
> [ 1402.287632] [<ffffffff8113ff8b>] sys_write+0x48/0x6f
> [ 1402.287632] [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b
> [ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff
> [ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85
> [ 1402.287632] RIP [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
> [ 1402.287632] RSP <ffff880077f0fd68>
> [ 1402.287632] CR2: ffff880077c49fff
> [ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]---
>
> Cc: "J. Bruce Fields" <bfields@fieldses.org>
> Cc: Neil Brown <neilb@suse.de>
> Cc: linux-nfs@vger.kernel.org
> Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
> ---
> fs/nfsd/export.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
> index 62f3b90..5f312ab 100644
> --- a/fs/nfsd/export.c
> +++ b/fs/nfsd/export.c
> @@ -87,7 +87,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
> struct svc_expkey key;
> struct svc_expkey *ek = NULL;
>
> - if (mesg[mlen-1] != '\n')
> + if (mlen < 1 || mesg[mlen-1] != '\n')
> return -EINVAL;
> mesg[mlen-1] = 0;
>
> --
> 1.7.8.rc1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2011-11-22 20:28 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-18 10:14 [PATCH] nfsd: Fix oops when parsing a 0 length export Sasha Levin
2011-11-22 20:28 ` J. Bruce Fields [this message]
2011-11-22 20:33 ` Sasha Levin
2011-11-22 20:59 ` J. Bruce Fields
2012-01-16 11:52 ` [patch] nfsd: oopses in cache_parse() Dan Carpenter
2012-01-16 15:50 ` J. Bruce Fields
2012-01-18 9:55 ` Dan Carpenter
2012-01-18 9:56 ` [patch] nfsd: don't allow zero length strings " Dan Carpenter
2012-01-18 22:41 ` J. Bruce Fields
2012-01-20 7:48 ` [patch] nfsd: remove some unneeded checks Dan Carpenter
2012-01-20 18:35 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111122202817.GD21451@fieldses.org \
--to=bfields@fieldses.org \
--cc=levinsasha928@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=neilb@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.