From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: linux-nfs-owner@vger.kernel.org Received: from fieldses.org ([174.143.236.118]:42919 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756570Ab1KVU2U (ORCPT ); Tue, 22 Nov 2011 15:28:20 -0500 Date: Tue, 22 Nov 2011 15:28:17 -0500 From: "J. Bruce Fields" To: Sasha Levin Cc: linux-kernel@vger.kernel.org, Neil Brown , linux-nfs@vger.kernel.org Subject: Re: [PATCH] nfsd: Fix oops when parsing a 0 length export Message-ID: <20111122202817.GD21451@fieldses.org> References: <1321611289-21809-1-git-send-email-levinsasha928@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: <1321611289-21809-1-git-send-email-levinsasha928@gmail.com> Sender: linux-nfs-owner@vger.kernel.org List-ID: On Fri, Nov 18, 2011 at 12:14:49PM +0200, Sasha Levin wrote: > expkey_parse() oopses when handling a 0 length export. This is easily > triggerable from usermode by writing 0 bytes into > '/proc/[proc id]/net/rpc/nfsd.fh/channel'. Thanks--how did you run across this? --b. > > Below is the log: > > [ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff > [ 1402.287632] IP: [] expkey_parse+0x28/0x2e1 > [ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160 > [ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC > [ 1402.287632] CPU 1 > [ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6 > [ 1402.287632] RIP: 0010:[] [] expkey_parse+0x28/0x2e1 > [ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292 > [ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400 > [ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0 > [ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000 > [ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000 > [ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0 > [ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000 > [ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > [ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0 > [ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > [ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0) > [ 1402.287632] Stack: > [ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e > [ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0 > [ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63 > [ 1402.287632] Call Trace: > [ 1402.287632] [] ? lock_release+0x1af/0x1bc > [ 1402.287632] [] ? might_fault+0x97/0x9e > [ 1402.287632] [] ? might_fault+0x4e/0x9e > [ 1402.287632] [] cache_do_downcall+0x3e/0x4f > [ 1402.287632] [] cache_write.clone.16+0xbb/0x130 > [ 1402.287632] [] ? cache_write_pipefs+0x1a/0x1a > [ 1402.287632] [] cache_write_procfs+0x19/0x1b > [ 1402.287632] [] proc_reg_write+0x8e/0xad > [ 1402.287632] [] vfs_write+0xaa/0xfd > [ 1402.287632] [] ? fget_light+0x35/0x9e > [ 1402.287632] [] sys_write+0x48/0x6f > [ 1402.287632] [] system_call_fastpath+0x16/0x1b > [ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff > [ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85 > [ 1402.287632] RIP [] expkey_parse+0x28/0x2e1 > [ 1402.287632] RSP > [ 1402.287632] CR2: ffff880077c49fff > [ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]--- > > Cc: "J. Bruce Fields" > Cc: Neil Brown > Cc: linux-nfs@vger.kernel.org > Signed-off-by: Sasha Levin > --- > fs/nfsd/export.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c > index 62f3b90..5f312ab 100644 > --- a/fs/nfsd/export.c > +++ b/fs/nfsd/export.c > @@ -87,7 +87,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen) > struct svc_expkey key; > struct svc_expkey *ek = NULL; > > - if (mesg[mlen-1] != '\n') > + if (mlen < 1 || mesg[mlen-1] != '\n') > return -EINVAL; > mesg[mlen-1] = 0; > > -- > 1.7.8.rc1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html