From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Chuck Lever <chuck.lever@oracle.com>,
Trond Myklebust <Trond.Myklebust@netapp.com>
Subject: [09/49] NFS: Fix panic after nfs_umount()
Date: Wed, 05 Jan 2011 15:00:27 -0800 [thread overview]
Message-ID: <20110105230324.304662136@clark.site> (raw)
In-Reply-To: <20110105230438.GA26241@kroah.com>
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 5b362ac3799ff4225c40935500f520cad4d7ed66 upstream.
After a few unsuccessful NFS mount attempts in which the client and
server cannot agree on an authentication flavor both support, the
client panics. nfs_umount() is invoked in the kernel in this case.
Turns out nfs_umount()'s UMNT RPC invocation causes the RPC client to
write off the end of the rpc_clnt's iostat array. This is because the
mount client's nrprocs field is initialized with the count of defined
procedures (two: MNT and UMNT), rather than the size of the client's
proc array (four).
The fix is to use the same initialization technique used by most other
upper layer clients in the kernel.
Introduced by commit 0b524123, which failed to update nrprocs when
support was added for UMNT in the kernel.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=24302
BugLink: http://bugs.launchpad.net/bugs/683938
Reported-by: Stefan Bader <stefan.bader@canonical.com>
Tested-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/nfs/mount_clnt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -503,13 +503,13 @@ static struct rpc_procinfo mnt3_procedur
static struct rpc_version mnt_version1 = {
.number = 1,
- .nrprocs = 2,
+ .nrprocs = ARRAY_SIZE(mnt_procedures),
.procs = mnt_procedures,
};
static struct rpc_version mnt_version3 = {
.number = 3,
- .nrprocs = 2,
+ .nrprocs = ARRAY_SIZE(mnt3_procedures),
.procs = mnt3_procedures,
};
next prev parent reply other threads:[~2011-01-05 23:12 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-05 23:04 [00/49] 2.6.32.28-longterm review Greg KH
2011-01-05 23:00 ` Greg KH
2011-01-05 23:00 ` [01/49] TTY: Fix error return from tty_ldisc_open() Greg KH
2011-01-05 23:00 ` [02/49] x86, hotplug: Use mwait to offline a processor, fix the legacy case Greg KH
2011-01-05 23:00 ` [03/49] fuse: verify ioctl retries Greg KH
2011-01-05 23:00 ` [04/49] fuse: fix ioctl when server is 32bit Greg KH
2011-01-05 23:00 ` [05/49] ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture Greg KH
2011-01-05 23:00 ` [06/49] drm/kms: remove spaces from connector names (v2) Greg KH
2011-01-05 23:49 ` [Stable-review] " Ben Hutchings
2011-01-05 23:56 ` Greg KH
2011-01-06 0:04 ` Ben Hutchings
2011-01-06 0:32 ` Alex Deucher
2011-01-05 23:00 ` [07/49] nohz: Fix printk_needs_cpu() return value on offline cpus Greg KH
2011-01-05 23:00 ` [08/49] nohz: Fix get_next_timer_interrupt() vs cpu hotplug Greg KH
2011-01-05 23:00 ` Greg KH [this message]
2011-01-05 23:00 ` [10/49] nfsd: Fix possible BUG_ON firing in set_change_info Greg KH
2011-01-05 23:00 ` [11/49] NFS: Fix fcntl F_GETLK not reporting some conflicts Greg KH
2011-01-05 23:00 ` [12/49] sunrpc: prevent use-after-free on clearing XPT_BUSY Greg KH
2011-01-05 23:00 ` [13/49] hwmon: (adm1026) Allow 1 as a valid divider value Greg KH
2011-01-05 23:00 ` [14/49] hwmon: (adm1026) Fix setting fan_div Greg KH
2011-01-05 23:00 ` [15/49] amd64_edac: Fix interleaving check Greg KH
2011-01-05 23:00 ` [16/49] IB/uverbs: Handle large number of entries in poll CQ Greg KH
2011-01-05 23:00 ` [17/49] PM / Hibernate: Fix PM_POST_* notification with user-space suspend Greg KH
2011-01-05 23:00 ` [18/49] ACPICA: Fix Scope() op in module level code Greg KH
2011-01-05 23:00 ` [19/49] ACPI: EC: Add another dmi match entry for MSI hardware Greg KH
2011-01-05 23:00 ` [20/49] orinoco: fix TKIP countermeasure behaviour Greg KH
2011-01-05 23:00 ` [21/49] orinoco: clear countermeasure setting on commit Greg KH
2011-01-05 23:00 ` [22/49] x86, amd: Fix panic on AMD CPU family 0x15 Greg KH
2011-01-05 23:00 ` [23/49] md: fix bug with re-adding of partially recovered device Greg KH
2011-01-05 23:00 ` [24/49] tracing: Fix panic when lseek() called on "trace" opened for writing Greg KH
2011-01-05 23:00 ` [25/49] x86, gcc-4.6: Use gcc -m options when building vdso Greg KH
2011-01-05 23:00 ` [26/49] x86: Enable the intr-remap fault handling after local APIC setup Greg KH
2011-01-05 23:00 ` [27/49] x86, vt-d: Handle previous faults after enabling fault handling Greg KH
2011-01-05 23:00 ` [28/49] x86, vt-d: Fix the vt-d fault handling irq migration in the x2apic mode Greg KH
2011-01-05 23:00 ` [29/49] x86, vt-d: Quirk for masking vtd spec errors to platform error handling logic Greg KH
2011-01-05 23:00 ` [30/49] hvc_console: Fix race between hvc_close and hvc_remove Greg KH
2011-01-05 23:00 ` [31/49] hvc_console: Fix race between hvc_close and hvc_remove, again Greg KH
2011-01-05 23:00 ` [32/49] HID: hidraw: fix window in hidraw_release Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110105230324.304662136@clark.site \
--to=gregkh@suse.de \
--cc=Trond.Myklebust@netapp.com \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=chuck.lever@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox