[PATCH] SUNRPC: Invalid BUG_ON() popping in rpc_release_task()

[Steve Dickson <SteveD@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 880 bytes --]

Over the weekend, while doing some Secure NFS testing, I found
that the BUG_ON() in  rpc_release_task() would pop when
the Kerberos server was not set up correctly (which I know is a
very common problem when people start using this feature).

The code path looks like:
rpc_call_sync() calls rpc_call_setup() which calls rpcauth_bindcred()
which fails (due to a krb5 problem) and sets tk_status to -EACCES.

Back in rpc_call_sync(), since (tk_status != 0) rpc_release_task()
is called. Unfortunately, since this task was never active,
(meaning rpc_execute() and rpc_set_active() were never called)
the tk_magic id was never set and the global task list was
never set up. So when rpc_release_task() is call, the world
come tumbling down...

So the attached patch ensures the RPC_TASK_ACTIVE run state bit
is set before calling the BUG_ON() and cleaning up the task
list.


steved.


[-- Attachment #2: linux-2.6.20-rpc-sec-error.patch --]
[-- Type: text/x-patch, Size: 1024 bytes --]

Only check the magic number and clean the tk_task queue
iff the task was active. 

Signed-off-by: Steve Dickson <steved@redhat.com>
-------------------------------------------------
--- nfs-2.6/net/sunrpc/sched.c.orig	2006-12-23 07:03:31.000000000 -0500
+++ nfs-2.6/net/sunrpc/sched.c	2007-01-21 06:17:32.000000000 -0500
@@ -898,16 +898,18 @@ EXPORT_SYMBOL(rpc_put_task);
 
 void rpc_release_task(struct rpc_task *task)
 {
-#ifdef RPC_DEBUG
-	BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
-#endif
 	dprintk("RPC: %4d release task\n", task->tk_pid);
 
-	/* Remove from global task list */
-	spin_lock(&rpc_sched_lock);
-	list_del(&task->tk_task);
-	spin_unlock(&rpc_sched_lock);
+	if (test_bit(RPC_TASK_ACTIVE, &task->tk_runstate)) {
+#ifdef RPC_DEBUG
+		BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
+#endif
 
+		/* Remove from global task list */
+		spin_lock(&rpc_sched_lock);
+		list_del(&task->tk_task);
+		spin_unlock(&rpc_sched_lock);
+	}
 	BUG_ON (RPC_IS_QUEUED(task));
 
 	/* Synchronously delete any running timer */

[-- Attachment #3: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #4: Type: text/plain, Size: 140 bytes --]

_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs