From: Jan Psota <jasiu@belsznica.pl>
To: linux-nfs@vger.kernel.org
Subject: Re: refcount underflow in nfsd41_destroy_cb
Date: Sat, 21 Mar 2020 18:25:52 +0100 [thread overview]
Message-ID: <20200321182552.0f68ad2a.jasiu@belsznica.pl> (raw)
In-Reply-To: <20200321154128.58eb8ef2.jasiu@belsznica.pl>
[-- Attachment #1: Type: text/plain, Size: 84 bytes --]
Hi! 3-rd trace. If it is enough, so you want me not to send next, just
let me know.
[-- Attachment #2: nfsd-trace3.txt --]
[-- Type: text/plain, Size: 3481 bytes --]
[53545.848242] ------------[ cut here ]------------
[53545.848246] refcount_t: underflow; use-after-free.
[53545.848283] WARNING: CPU: 0 PID: 22784 at lib/refcount.c:28 refcount_warn_saturate+0xd9/0xe0
[53545.848285] Modules linked in: md5 wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 ip6_udp_tunnel udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic xt_mac xt_nat xt_MASQUERADE xt_REDIRECT xt_owner xt_comment ipt_REJECT nf_reject_ipv4 xt_mark xt_hashlimit xt_multiport nfnetlink_log xt_NFLOG nf_log_ipv4 nf_log_common xt_LOG nf_nat_tftp nf_nat_sip nf_nat_h323 nf_nat_ftp nf_conntrack_tftp nf_conntrack_sip nf_conntrack_netlink nfnetlink nf_conntrack_h323 nf_conntrack_ftp nfsd auth_rpcgss nfs_acl lockd grace sunrpc cpufreq_ondemand msr bridge stp llc xt_tcpudp xt_conntrack iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_raw iptable_filter ip_tables x_tables btrfs blake2b_generic xor raid6_pq libcrc32c zstd_compress zstd_decompress zlib_deflate zlib_inflate uas usb_storage snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel matroxfb_base snd_intel_dspcfg snd_hda_codec matroxfb_g
450
[53545.848354] snd_hda_core matroxfb_Ti3026 matroxfb_accel r8169 cfbfillrect cfbimgblt snd_hwdep e1000e realtek libphy cfbcopyarea snd_pcm mxm_wmi pcspkr matroxfb_DAC1064 g450_pll snd_timer matroxfb_misc input_leds atlantic fb snd wmi fbdev xhci_pci k10temp xhci_hcd i2c_piix4 ptp soundcore pps_core ohci_pci i2c_core ohci_hcd ehci_pci ehci_hcd acpi_cpufreq vhci_hcd usbip_core usbcore usb_common vhost_net vhost kvm_amd kvm irqbypass loop tun fuse it87 hwmon_vid hwmon
[53545.848402] CPU: 0 PID: 22784 Comm: kworker/u16:0 Not tainted 5.6.0-rc6 #1
[53545.848405] Hardware name: Gigabyte Technology Co., Ltd. GA-990FXA-UD5/GA-990FXA-UD5, BIOS F12 10/03/2013
[53545.848432] Workqueue: rpciod rpc_async_schedule [sunrpc]
[53545.848440] RIP: 0010:refcount_warn_saturate+0xd9/0xe0
[53545.848446] Code: ff 48 c7 c7 e8 ff d5 81 c6 05 cd 49 b5 00 01 e8 4d 04 cf ff 0f 0b c3 48 c7 c7 90 ff d5 81 c6 05 b9 49 b5 00 01 e8 37 04 cf ff <0f> 0b c3 0f 1f 40 00 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 46 8d
[53545.848449] RSP: 0018:ffffc900045efde0 EFLAGS: 00010282
[53545.848452] RAX: 0000000000000026 RBX: 0000000000000e81 RCX: 0000000000000007
[53545.848455] RDX: 0000000000000007 RSI: 0000000000000092 RDI: ffff88881fc187c0
[53545.848457] RBP: ffff8887ee7b2c70 R08: 00000000000004ef R09: 0000000000000001
[53545.848459] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8884f1a10510
[53545.848462] R13: ffff88815792f530 R14: 0000000000000001 R15: ffff8882343c1300
[53545.848465] FS: 0000000000000000(0000) GS:ffff88881fc00000(0000) knlGS:0000000000000000
[53545.848467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[53545.848470] CR2: 0000000002600000 CR3: 0000000511560000 CR4: 00000000000006f0
[53545.848471] Call Trace:
[53545.848501] nfsd41_destroy_cb+0x36/0x50 [nfsd]
[53545.848524] rpc_free_task+0x3c/0x70 [sunrpc]
[53545.848544] __rpc_execute+0x3a5/0x3c0 [sunrpc]
[53545.848552] ? finish_task_switch+0x7f/0x250
[53545.848571] rpc_async_schedule+0x2f/0x50 [sunrpc]
[53545.848578] process_one_work+0x1ca/0x3c0
[53545.848584] worker_thread+0x45/0x3d0
[53545.848590] kthread+0xf3/0x130
[53545.848595] ? process_one_work+0x3c0/0x3c0
[53545.848599] ? kthread_park+0x80/0x80
[53545.848607] ret_from_fork+0x1f/0x30
[53545.848613] ---[ end trace dfea44b545c7626a ]---
next prev parent reply other threads:[~2020-03-21 17:25 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-21 2:51 refcount underflow in nfsd41_destroy_cb Jason A. Donenfeld
2020-03-21 14:41 ` Jan Psota
2020-03-21 17:25 ` Jan Psota [this message]
2020-05-10 23:23 ` Jan Psota
2020-05-15 22:01 ` J. Bruce Fields
2020-03-21 19:50 ` Chuck Lever
2020-03-22 3:43 ` Jan Psota
2020-03-23 14:13 ` Chuck Lever
2020-03-23 15:09 ` Jan Psota
2020-03-24 13:50 ` Chuck Lever
2020-03-31 17:59 ` Chuck Lever
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200321182552.0f68ad2a.jasiu@belsznica.pl \
--to=jasiu@belsznica.pl \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).