From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Scott Mayhew <smayhew@redhat.com>,
Trond Myklebust <trond.myklebust@primarydata.com>
Subject: [PATCH 4.13 08/53] nfs/filelayout: fix oops when freeing filelayout segment
Date: Mon, 16 Oct 2017 18:16:05 +0200 [thread overview]
Message-ID: <20171016161442.580068988@linuxfoundation.org> (raw)
In-Reply-To: <20171016161442.263947886@linuxfoundation.org>
4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <smayhew@redhat.com>
commit 0a47df11bfc31e1ceae7f91cea84d3bff500475d upstream.
Check for a NULL dsaddr in filelayout_free_lseg() before calling
nfs4_fl_put_deviceid(). This fixes the following oops:
[ 1967.645207] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[ 1967.646010] IP: [<ffffffffc06d6aea>] nfs4_put_deviceid_node+0xa/0x90 [nfsv4]
[ 1967.646010] PGD c08bc067 PUD 915d3067 PMD 0
[ 1967.753036] Oops: 0000 [#1] SMP
[ 1967.753036] Modules linked in: nfs_layout_nfsv41_files ext4 mbcache jbd2 loop rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache amd64_edac_mod ipmi_ssif edac_mce_amd edac_core kvm_amd sg kvm ipmi_si ipmi_devintf irqbypass pcspkr k8temp ipmi_msghandler i2c_piix4 shpchp nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common amdkfd amd_iommu_v2 radeon i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops mptsas ttm scsi_transport_sas mptscsih drm mptbase serio_raw i2c_core bnx2 dm_mirror dm_region_hash dm_log dm_mod
[ 1967.790031] CPU: 2 PID: 1370 Comm: ls Not tainted 3.10.0-709.el7.test.bz1463784.x86_64 #1
[ 1967.790031] Hardware name: IBM BladeCenter LS21 -[7971AC1]-/Server Blade, BIOS -[BAE155AUS-1.10]- 06/03/2009
[ 1967.790031] task: ffff8800c42a3f40 ti: ffff8800c4064000 task.ti: ffff8800c4064000
[ 1967.790031] RIP: 0010:[<ffffffffc06d6aea>] [<ffffffffc06d6aea>] nfs4_put_deviceid_node+0xa/0x90 [nfsv4]
[ 1967.790031] RSP: 0000:ffff8800c4067978 EFLAGS: 00010246
[ 1967.790031] RAX: ffffffffc062f000 RBX: ffff8801d468a540 RCX: dead000000000200
[ 1967.790031] RDX: ffff8800c40679f8 RSI: ffff8800c4067a0c RDI: 0000000000000000
[ 1967.790031] RBP: ffff8800c4067980 R08: ffff8801d468a540 R09: 0000000000000000
[ 1967.790031] R10: 0000000000000000 R11: ffffffffffffffff R12: ffff8801d468a540
[ 1967.790031] R13: ffff8800c40679f8 R14: ffff8801d5645300 R15: ffff880126f15ff0
[ 1967.790031] FS: 00007f11053c9800(0000) GS:ffff88012bd00000(0000) knlGS:0000000000000000
[ 1967.790031] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1967.790031] CR2: 0000000000000030 CR3: 0000000094b55000 CR4: 00000000000007e0
[ 1967.790031] Stack:
[ 1967.790031] ffff8801d468a540 ffff8800c4067990 ffffffffc062d2fe ffff8800c40679b0
[ 1967.790031] ffffffffc062b5b4 ffff8800c40679f8 ffff8801d468a540 ffff8800c40679d8
[ 1967.790031] ffffffffc06d39af ffff8800c40679f8 ffff880126f16078 0000000000000001
[ 1967.790031] Call Trace:
[ 1967.790031] [<ffffffffc062d2fe>] nfs4_fl_put_deviceid+0xe/0x10 [nfs_layout_nfsv41_files]
[ 1967.790031] [<ffffffffc062b5b4>] filelayout_free_lseg+0x24/0x90 [nfs_layout_nfsv41_files]
[ 1967.790031] [<ffffffffc06d39af>] pnfs_free_lseg_list+0x5f/0x80 [nfsv4]
[ 1967.790031] [<ffffffffc06d5a67>] _pnfs_return_layout+0x157/0x270 [nfsv4]
[ 1967.790031] [<ffffffffc06c17dd>] nfs4_evict_inode+0x4d/0x70 [nfsv4]
[ 1967.790031] [<ffffffff8121de19>] evict+0xa9/0x180
[ 1967.790031] [<ffffffff8121e729>] iput+0xf9/0x190
[ 1967.790031] [<ffffffffc0652cea>] nfs_dentry_iput+0x3a/0x50 [nfs]
[ 1967.790031] [<ffffffff8121ab4f>] shrink_dentry_list+0x20f/0x490
[ 1967.790031] [<ffffffff8121b018>] d_invalidate+0xd8/0x150
[ 1967.790031] [<ffffffffc065446b>] nfs_readdir_page_filler+0x40b/0x600 [nfs]
[ 1967.790031] [<ffffffffc0654bbd>] nfs_readdir_xdr_to_array+0x20d/0x3b0 [nfs]
[ 1967.790031] [<ffffffff811f3482>] ? __mem_cgroup_commit_charge+0xe2/0x2f0
[ 1967.790031] [<ffffffff81183208>] ? __add_to_page_cache_locked+0x48/0x170
[ 1967.790031] [<ffffffffc0654d60>] ? nfs_readdir_xdr_to_array+0x3b0/0x3b0 [nfs]
[ 1967.790031] [<ffffffffc0654d82>] nfs_readdir_filler+0x22/0x90 [nfs]
[ 1967.790031] [<ffffffff8118351f>] do_read_cache_page+0x7f/0x190
[ 1967.790031] [<ffffffff81215d30>] ? fillonedir+0xe0/0xe0
[ 1967.790031] [<ffffffff8118366c>] read_cache_page+0x1c/0x30
[ 1967.790031] [<ffffffffc0654f9b>] nfs_readdir+0x1ab/0x6b0 [nfs]
[ 1967.790031] [<ffffffffc06bd1c0>] ? nfs4_xdr_dec_layoutget+0x270/0x270 [nfsv4]
[ 1967.790031] [<ffffffff81215d30>] ? fillonedir+0xe0/0xe0
[ 1967.790031] [<ffffffff81215c20>] vfs_readdir+0xb0/0xe0
[ 1967.790031] [<ffffffff81216045>] SyS_getdents+0x95/0x120
[ 1967.790031] [<ffffffff816b9449>] system_call_fastpath+0x16/0x1b
[ 1967.790031] Code: 90 31 d2 48 89 d0 5d c3 85 f6 74 f5 8d 4e 01 89 f0 f0 0f b1 0f 39 f0 74 e2 89 c6 eb eb 0f 1f 40 00 66 66 66 66 90 55 48 89 e5 53 <48> 8b 47 30 48 89 fb a8 04 74 3b 8b 57 60 83 fa 02 74 19 8d 4a
[ 1967.790031] RIP [<ffffffffc06d6aea>] nfs4_put_deviceid_node+0xa/0x90 [nfsv4]
[ 1967.790031] RSP <ffff8800c4067978>
[ 1967.790031] CR2: 0000000000000030
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Fixes: 1ebf98012792 ("NFS/filelayout: Fix racy setting of fl->dsaddr...")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/filelayout/filelayout.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -745,7 +745,8 @@ filelayout_free_lseg(struct pnfs_layout_
struct nfs4_filelayout_segment *fl = FILELAYOUT_LSEG(lseg);
dprintk("--> %s\n", __func__);
- nfs4_fl_put_deviceid(fl->dsaddr);
+ if (fl->dsaddr != NULL)
+ nfs4_fl_put_deviceid(fl->dsaddr);
/* This assumes a single RW lseg */
if (lseg->pls_range.iomode == IOMODE_RW) {
struct nfs4_filelayout *flo;
next prev parent reply other threads:[~2017-10-16 16:25 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-16 16:15 [PATCH 4.13 00/53] 4.13.8-stable review Greg Kroah-Hartman
2017-10-16 16:15 ` [PATCH 4.13 01/53] USB: dummy-hcd: Fix deadlock caused by disconnect detection Greg Kroah-Hartman
2017-10-16 16:15 ` [PATCH 4.13 02/53] MIPS: math-emu: Remove pr_err() calls from fpu_emu() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 03/53] MIPS: bpf: Fix uninitialised target compiler error Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 04/53] mei: always use domain runtime pm callbacks Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 05/53] dmaengine: edma: Align the memcpy acnt array size with the transfer Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 06/53] dmaengine: ti-dma-crossbar: Fix possible race condition with dma_inuse Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 07/53] NFS: Fix uninitialized rpc_wait_queue Greg Kroah-Hartman
2017-10-16 16:16 ` Greg Kroah-Hartman [this message]
2017-10-16 16:16 ` [PATCH 4.13 09/53] HID: usbhid: fix out-of-bounds bug Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 12/53] KVM: MMU: always terminate page walks at level 1 Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 13/53] KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 14/53] usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 16/53] iommu/amd: Finish TLB flush in amd_iommu_unmap() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 17/53] device property: Track owner device of device property Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 18/53] Revert "vmalloc: back off when the current task is killed" Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 19/53] fs/mpage.c: fix mpage_writepage() for pages with buffers Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 20/53] ALSA: usb-audio: Kill stray URB at exiting Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 21/53] ALSA: seq: Fix use-after-free at creating a port Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 22/53] ALSA: seq: Fix copy_from_user() call inside lock Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 23/53] ALSA: caiaq: Fix stray URB at probe error path Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 24/53] ALSA: line6: Fix NULL dereference at podhd_disconnect() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 25/53] ALSA: line6: Fix missing initialization before error path Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 26/53] ALSA: line6: Fix leftover URB at error-path during probe Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 27/53] drm/atomic: Unref duplicated drm_atomic_state in drm_atomic_helper_resume() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 28/53] drm/i915/edp: Get the Panel Power Off timestamp after panel is off Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 29/53] drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 31/53] drm/i915: Use crtc_state_is_legacy_gamma in intel_color_check Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 32/53] usb: gadget: configfs: Fix memory leak of interface directory data Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 33/53] usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 34/53] PCI: aardvark: Move to struct pci_host_bridge IRQ mapping functions Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 35/53] Revert "PCI: tegra: Do not allocate MSI target memory" Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 36/53] direct-io: Prevent NULL pointer access in submit_page_section Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 37/53] fix unbalanced page refcounting in bio_map_user_iov Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 38/53] more bio_map_user_iov() leak fixes Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 39/53] bio_copy_user_iov(): dont ignore ->iov_offset Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 40/53] perf script: Add missing separator for "-F ip,brstack" (and brstackoff) Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 41/53] genirq/cpuhotplug: Enforce affinity setting on startup of managed irqs Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 42/53] genirq/cpuhotplug: Add sanity check for effective affinity mask Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 43/53] USB: serial: ftdi_sio: add id for Cypress WICED dev board Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 44/53] USB: serial: cp210x: fix partnum regression Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 45/53] USB: serial: cp210x: add support for ELV TFD500 Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 46/53] USB: serial: option: add support for TP-Link LTE module Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 47/53] USB: serial: qcserial: add Dell DW5818, DW5819 Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 48/53] USB: serial: console: fix use-after-free on disconnect Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 49/53] USB: serial: console: fix use-after-free after failed setup Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 50/53] RAS/CEC: Use the right length for "cec_disable" Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 51/53] x86/microcode: Do the family check first Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 52/53] x86/alternatives: Fix alt_max_short macro to really be a max() Greg Kroah-Hartman
2017-10-16 16:16 ` [PATCH 4.13 53/53] KVM: nVMX: update last_nonleaf_level when initializing nested EPT Greg Kroah-Hartman
2017-10-16 23:41 ` [PATCH 4.13 00/53] 4.13.8-stable review Shuah Khan
2017-10-17 6:59 ` Greg Kroah-Hartman
2017-10-17 0:25 ` Guenter Roeck
2017-10-17 13:21 ` Greg Kroah-Hartman
[not found] ` <20171016161443.534299546@linuxfoundation.org>
[not found] ` <866e97b1-08dd-fd43-7713-699759f63fcf@3CityElectronics.com>
2017-10-17 7:02 ` [PATCH 4.13 30/53] drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX channel Jani Nikula
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171016161442.580068988@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=smayhew@redhat.com \
--cc=stable@vger.kernel.org \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.