From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Dickson Subject: [PATCH] NFS/RPC/GSS - oops in gss_pipe_release() Date: Fri, 16 Sep 2005 13:40:15 -0400 Message-ID: <432B037F.7020308@RedHat.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------010204060405000401060507" Return-path: Received: from sc8-sf-mx2-b.sourceforge.net ([10.3.1.92] helo=mail.sourceforge.net) by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30) id 1EGKCF-00065t-8I for nfs@lists.sourceforge.net; Fri, 16 Sep 2005 10:40:23 -0700 Received: from mx1.redhat.com ([66.187.233.31]) by mail.sourceforge.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44) id 1EGKCF-0005Zm-0W for nfs@lists.sourceforge.net; Fri, 16 Sep 2005 10:40:23 -0700 Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by mx1.redhat.com (8.12.11/8.12.11) with ESMTP id j8GHeGx7007149 for ; Fri, 16 Sep 2005 13:40:16 -0400 Received: from lacrosse.corp.redhat.com (lacrosse.corp.redhat.com [172.16.52.154]) by int-mx1.corp.redhat.com (8.11.6/8.11.6) with ESMTP id j8GHeGV30361 for ; Fri, 16 Sep 2005 13:40:16 -0400 Received: from [172.16.80.110] (IDENT:U2FsdGVkX1+YSRw3V6ds9LB20olsyF7THXzJ3VjW/Kg@dickson.boston.redhat.com [172.16.80.110]) by lacrosse.corp.redhat.com (8.11.6/8.11.6) with ESMTP id j8GHeG428888 for ; Fri, 16 Sep 2005 13:40:16 -0400 To: nfs@lists.sourceforge.net Sender: nfs-admin@lists.sourceforge.net Errors-To: nfs-admin@lists.sourceforge.net List-Unsubscribe: , List-Id: Discussion of NFS under Linux development, interoperability, and testing. List-Post: List-Help: List-Subscribe: , List-Archive: This is a multi-part message in MIME format. --------------010204060405000401060507 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit During some recent debugging I found that an oops can occur in gss_pipe_release() because the client handle that is being passed in has already been freed. The scenario is as follows: root# mount -o sec=krb5 server:/export /mnt/export user$ ls /mnt/export (which hangs because user does not have the correct credentials) root# reboot The oops occurs when the /mnt/export filesystem is unmounted. The reason being is gss_pipe_release() was already called when the ls process was killed. The stack dump of the ls process was: [] gss_pipe_release+0x74/0xd8 [auth_rpcgss] [] rpc_pipe_release+0xa5/0xb9 [sunrpc] [] __fput+0x55/0x100 [] filp_close+0x59/0x5f [] put_files_struct+0x57/0xc0 [] do_exit+0x227/0x3de [] sys_exit_group+0x0/0xd [] syscall_call+0x7/0xb So when the rpc_shutdown_client code is called via the umount: [] gss_pipe_release+0x74/0xd8 [auth_rpcgss] [] rpc_close_pipes+0x80/0x9a [sunrpc] [] rpc_depopulate+0xfb/0x142 [sunrpc] [] cached_lookup+0xf/0x56 [] __lookup_hash+0x46/0x89 [] rpc_rmdir+0x5a/0x89 [sunrpc] [] rpcauth_free_credcache+0x87/0xd0 [sunrpc] [] rpc_destroy_client+0x70/0xa4 [sunrpc] [] rpc_destroy_client+0x60/0xa4 [sunrpc] [] rpc_shutdown_client+0xd1/0xd8 [sunrpc] [] default_wake_function+0x0/0xc [] nfs_kill_super+0x38/0x63 [nfs] the client handle (which is in the rpc_inode) passed to gss_pipe_release() has already been freeded. It appears from other places in the code (namely rpc_close_pipes()) that the only way to invalidate an rpc_inode is to set the ops pointer to NULL which is what the attached patch does. Is there a better way to invalid an rpc_inode? steved. --------------010204060405000401060507 Content-Type: text/x-patch; name="linux-2.6.13-rpc-gss-release.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="linux-2.6.13-rpc-gss-release.patch" This patch stops the release_pipe() funtion from being called twice by invalidating the ops pointer in the rpc_inode when rpc_pipe_release() is called. Signed-off-by: Steve Dickson ------------------------------------------------------ --- linux-2.6.13/net/sunrpc/rpc_pipe.c.orig 2005-08-28 19:41:01.000000000 -0400 +++ linux-2.6.13/net/sunrpc/rpc_pipe.c 2005-09-16 11:18:53.598157000 -0400 @@ -177,6 +177,8 @@ rpc_pipe_release(struct inode *inode, st __rpc_purge_upcall(inode, -EPIPE); if (rpci->ops->release_pipe) rpci->ops->release_pipe(inode); + if (!rpci->nreaders && !rpci->nwriters) + rpci->ops = NULL; out: up(&inode->i_sem); return 0; --------------010204060405000401060507-- ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs