Resending since this problem still appears to be in both the -mm and mainline kernels.. steved. -------- Original Message -------- Subject: [PATCH] NFS/RPC/GSS - oops in gss_pipe_release() Date: Fri, 16 Sep 2005 13:40:15 -0400 From: Steve Dickson To: nfs@lists.sourceforge.net During some recent debugging I found that an oops can occur in gss_pipe_release() because the client handle that is being passed in has already been freed. The scenario is as follows: 1) root# mount -o sec=krb5 server:/export /mnt/export 2) user$ ls /mnt/export (which hangs because user does not have the correct credentials) 3) root# reboot The oops occurs when the /mnt/export filesystem is unmounted. The reason being is gss_pipe_release() was already called when the ls process was killed. The stack dump of the ls process was: [] gss_pipe_release+0x74/0xd8 [auth_rpcgss] [] rpc_pipe_release+0xa5/0xb9 [sunrpc] [] __fput+0x55/0x100 [] filp_close+0x59/0x5f [] put_files_struct+0x57/0xc0 [] do_exit+0x227/0x3de [] sys_exit_group+0x0/0xd [] syscall_call+0x7/0xb So when the rpc_shutdown_client code is called via the umount: [] gss_pipe_release+0x74/0xd8 [auth_rpcgss] [] rpc_close_pipes+0x80/0x9a [sunrpc] [] rpc_depopulate+0xfb/0x142 [sunrpc] [] cached_lookup+0xf/0x56 [] __lookup_hash+0x46/0x89 [] rpc_rmdir+0x5a/0x89 [sunrpc] [] rpcauth_free_credcache+0x87/0xd0 [sunrpc] [] rpc_destroy_client+0x70/0xa4 [sunrpc] [] rpc_destroy_client+0x60/0xa4 [sunrpc] [] rpc_shutdown_client+0xd1/0xd8 [sunrpc] [] default_wake_function+0x0/0xc [] nfs_kill_super+0x38/0x63 [nfs] the client handle (which is in the rpc_inode) passed to gss_pipe_release() has already been freeded. It appears from other places in the code (namely rpc_close_pipes()) that the only way to invalidate an rpc_inode is to set the ops pointer to NULL which is what the attached patch does. Is there a better way to invalid an rpc_inode? steved.