2.6.11-rc2-mm1: kernel bad access while booting diskless client

2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Albert Herranz]

[-- Attachment #1: Type: text/plain, Size: 1296 bytes --]

Hi,

I'm getting a kernel Oops while booting 2.6.11-rc2-mm1
on a diskless (nfsroot based) embedded ppc system.
Vanilla 2.6.11-rc2 works Ok.

[...]
VFS: Mounted root (nfs filesystem) readonly.
Freeing unused kernel memory: 112k init
INIT: version 2.86 booting
Oops: kernel access of bad area, sig: 11 [#1]
[...]
TASK = c1643ae0[1] 'init' THREAD: c1646000
Last syscall: 106
[...]
NIP [c0060934] vfs_getattr+0x1c/0xa8
LR [c0060a14] vfs_stat+0x54/0x64
Call trace:
 [c0060a14] vfs_sysstat+0x54/0x64
 [c0060f24] sys_newstat+0x1c/0x54
 [c0003c40] ret_from_syscall+0x0/0x44
Kernel panic - not syncing: Attempted to kill init!


The cause of the bad access is a null inode->i_op
field that is passed to vfs_getattr() through the
corresponding struct dentry.
It triggers when vfs_getattr() blindly tries to check
inode->i_op->getattr without first checking that
inode->i_op is useable.

The attached patch workarounds the problem, by
checking inode->i_op before using it.

It is still unknown to me which code change is causing
now the appearance of the null i_op field on -rc2-mm1.
But probably you guys have better clues than me.

Cheers,
Albert



	
	
		
______________________________________________ 
Renovamos el Correo Yahoo!: ¡250 MB GRATIS! 
Nuevos servicios, más seguridad 
http://correo.yahoo.es

[-- Attachment #2: fix-kernel-bad-access-on-nfsroot.patch --]
[-- Type: text/plain, Size: 354 bytes --]

--- a/fs/stat.c	2004-12-24 22:34:02.000000000 +0100
+++ b/fs/stat.c	2005-01-27 00:52:15.000000000 +0100
@@ -47,7 +47,7 @@ int vfs_getattr(struct vfsmount *mnt, st
 	if (retval)
 		return retval;
 
-	if (inode->i_op->getattr)
+	if (inode->i_op && inode->i_op->getattr)
 		return inode->i_op->getattr(mnt, dentry, stat);
 
 	generic_fillattr(inode, stat);

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Andrew Morton]

Albert Herranz <albert_herranz@yahoo.es> wrote:
>
> Hi,
> 
> I'm getting a kernel Oops while booting 2.6.11-rc2-mm1
> on a diskless (nfsroot based) embedded ppc system.
> Vanilla 2.6.11-rc2 works Ok.
> 
> [...]
> VFS: Mounted root (nfs filesystem) readonly.
> Freeing unused kernel memory: 112k init
> INIT: version 2.86 booting
> Oops: kernel access of bad area, sig: 11 [#1]
> [...]
> TASK = c1643ae0[1] 'init' THREAD: c1646000
> Last syscall: 106
> [...]
> NIP [c0060934] vfs_getattr+0x1c/0xa8
> LR [c0060a14] vfs_stat+0x54/0x64
> Call trace:
>  [c0060a14] vfs_sysstat+0x54/0x64
>  [c0060f24] sys_newstat+0x1c/0x54
>  [c0003c40] ret_from_syscall+0x0/0x44
> Kernel panic - not syncing: Attempted to kill init!
> 
> 
> The cause of the bad access is a null inode->i_op
> field that is passed to vfs_getattr() through the
> corresponding struct dentry.
> It triggers when vfs_getattr() blindly tries to check
> inode->i_op->getattr without first checking that
> inode->i_op is useable.
> 
> The attached patch workarounds the problem, by
> checking inode->i_op before using it.
> 
> It is still unknown to me which code change is causing
> now the appearance of the null i_op field on -rc2-mm1.
> But probably you guys have better clues than me.
> 

OK, that's super-helpful, thanks.

> --- a/fs/stat.c	2004-12-24 22:34:02.000000000 +0100
> +++ b/fs/stat.c	2005-01-27 00:52:15.000000000 +0100
> @@ -47,7 +47,7 @@ int vfs_getattr(struct vfsmount *mnt, st
>  	if (retval)
>  		return retval;
>  
> -	if (inode->i_op->getattr)
> +	if (inode->i_op && inode->i_op->getattr)
>  		return inode->i_op->getattr(mnt, dentry, stat);
>  
>  	generic_fillattr(inode, stat);
> 
> 
> 

Can you tell us which filesystem is being bad?  Add this:

	if (!inode->i_op)
		printk("%s is naughty\n", inode->i_sb->s_id);

It's probably NFS - there has been some work done in there in -mm.

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Albert Herranz]

 --- Andrew Morton <akpm@osdl.org> escribió: 
> Can you tell us which filesystem is being bad?  Add
> this:
> 
> 	if (!inode->i_op)
> 		printk("%s is naughty\n", inode->i_sb->s_id);
> 
> It's probably NFS - there has been some work done in
> there in -mm.

0:a is naughty

Cheers,
Albert



		
______________________________________________ 
Renovamos el Correo Yahoo!: ¡250 MB GRATIS! 
Nuevos servicios, más seguridad 
http://correo.yahoo.es

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Andreas Gruenbacher]

[-- Attachment #1: Type: text/plain, Size: 154 bytes --]

Hello,

here is a fix for a NULL pointer access problem with NFSv2 that isn't in
2.6.11-rc2-mm1, but it can't explain this NULL inode->i_op.

-- Andreas.

[-- Attachment #2: Type: message/rfc822, Size: 4739 bytes --]

From: Andreas Gruenbacher <agruen@suse.de>
To: Andrew Morton <akpm@osdl.org>, Neil Brown <neilb@cse.unsw.edu.au>, Trond Myklebust <trond.myklebust@fys.uio.no>, linux-kernel@vger.kernel.org
Cc: Olaf Kirch <okir@suse.de>, "Andries E. Brouwer" <Andries.Brouwer@cwi.nl>, Buck Huppmann <buchk@pobox.com>
Subject: Re: [patch 12/13] ACL umask handling workaround in nfs client
Date: Tue, 25 Jan 2005 02:20:41 +0100
Message-ID: <200501250220.41618.agruen@suse.de>

Hello,

this patch has an NFSv2 problem that I haven't tripped over until today. The 
fix is this:

------- 8< -------
Fix NFSv2 null pointer access

With NFSv2 we would try to follow a NULL getacl and setacl function
pointer here. Add the missing checks.

Signed-off-by: Andreas Gruenbacher <agruen@suse.de>

Index: linux-2.6.10/fs/nfs/dir.c
===================================================================
--- linux-2.6.10.orig/fs/nfs/dir.c
+++ linux-2.6.10/fs/nfs/dir.c
@@ -984,6 +984,9 @@ static int nfs_set_default_acl(struct in
 	struct posix_acl *dfacl, *acl;
 	int error = 0;
 
+	if (NFS_PROTO(inode)->version != 3 ||
+	    !NFS_PROTO(dir)->getacl || !NFS_PROTO(inode)->setacls)
+		return 0;
 	dfacl = NFS_PROTO(dir)->getacl(dir, ACL_TYPE_DEFAULT);
 	if (IS_ERR(dfacl)) {
 		error = PTR_ERR(dfacl);


Regards,
-- 
Andreas Gruenbacher <agruen@suse.de>
SUSE Labs, SUSE LINUX PRODUCTS GMBH
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Albert Herranz]

 --- Andreas Gruenbacher <agruen@suse.de> escribió: 
> Hello,
> 
> here is a fix for a NULL pointer access problem with
> NFSv2 that isn't in
> 2.6.11-rc2-mm1, but it can't explain this NULL
> inode->i_op.
> 
> -- Andreas.

Hi,

Yes, that patch seems unrelated.
Same Oops with or without it.

Thanks,
Albert



		
______________________________________________ 
Renovamos el Correo Yahoo!: ¡250 MB GRATIS! 
Nuevos servicios, más seguridad 
http://correo.yahoo.es

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Andreas Gruenbacher]

[-- Attachment #1: Type: text/plain, Size: 171 bytes --]

Hello again,

this looks like a good candidate. Could you please try if it fixes the
problem?

Thanks,
-- 
Andreas Gruenbacher <agruen@suse.de>
SUSE Labs, SUSE LINUX GMBH

[-- Attachment #2: nfsacl-iop-NULL-fix.diff --]
[-- Type: message/rfc822, Size: 1490 bytes --]

From: Andreas Gruenbacher <agruen@suse.de>
Subject: Must not initialize inode->i_op to NULL
Date: Fri, 28 Jan 2005 00:01:46 +0100
Message-ID: <1106866906.7616.55.camel@winden.suse.de>

This pattern from 2.4 times doesn't work very well anymore :(

Signed-off-by: Andreas Gruenbacher <agruen@suse.de>

Index: linux-2.6.11-latest/fs/nfs/inode.c
===================================================================
--- linux-2.6.11-latest.orig/fs/nfs/inode.c
+++ linux-2.6.11-latest/fs/nfs/inode.c
@@ -688,7 +688,7 @@ nfs_init_locked(struct inode *inode, voi
 #define NFS_LIMIT_READDIRPLUS (8*PAGE_SIZE)
 
 #ifdef CONFIG_NFS_ACL
-static struct inode_operations nfs_special_inode_operations[] = {{
+static struct inode_operations nfs_special_inode_operations = {
 	.permission =	nfs_permission,
 	.getattr =	nfs_getattr,
 	.setattr =	nfs_setattr,
@@ -696,9 +696,7 @@ static struct inode_operations nfs_speci
 	.getxattr =	nfs_getxattr,
 	.setxattr =	nfs_setxattr,
 	.removexattr =	nfs_removexattr,
-}};
-#else
-#define nfs_special_inode_operations NULL
+};
 #endif  /* CONFIG_NFS_ACL */
 
 /*
@@ -755,7 +753,9 @@ nfs_fhget(struct super_block *sb, struct
 		} else if (S_ISLNK(inode->i_mode))
 			inode->i_op = &nfs_symlink_inode_operations;
 		else {
-			inode->i_op = nfs_special_inode_operations;
+#ifdef CONFIG_NFS_ACL
+			inode->i_op = &nfs_special_inode_operations;
+#endif
 			init_special_inode(inode, inode->i_mode, fattr->rdev);
 		}
 

Re: 2.6.11-rc2-mm1: kernel bad access while booting diskless client

[Albert Herranz]

 --- Andreas Gruenbacher <agruen@suse.de> escribió: 
> Hello again,
> 
> this looks like a good candidate. Could you please
> try if it fixes the
> problem?

The Oops went away with this one.

> Thanks,

Your welcome.

Cheers,
Albert



		
______________________________________________ 
Renovamos el Correo Yahoo!: ¡250 MB GRATIS! 
Nuevos servicios, más seguridad 
http://correo.yahoo.es