davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
085b7a45c6
kernel-ark/fs/nfs
History
Weston Andros Adamson 085b7a45c6 NFSv4.1: Don't decode skipped layoutgets 
layoutget's prepare hook can call rpc_exit with status = NFS4_OK (0).
Because of this, nfs4_proc_layoutget can't depend on a 0 status to mean
that the RPC was successfully sent, received and parsed.

To fix this, use the result's len member to see if parsing took place.

This fixes the following OOPS -- calling xdr_init_decode() with a buffer length
0 doesn't set the stream's 'p' member and ends up using uninitialized memory
in filelayout_decode_layout.

BUG: unable to handle kernel paging request at 0000000000008050
IP: [<ffffffff81282e78>] memcpy+0x18/0x120
PGD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/irq
CPU 1
Modules linked in: nfs_layout_nfsv41_files nfs lockd fscache auth_rpcgss nfs_acl autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_mirror dm_region_hash dm_log dm_mod ppdev parport_pc parport snd_ens1371 snd_rawmidi snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000 microcode vmware_balloon i2c_piix4 i2c_core sg shpchp ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix mptspi mptscsih mptbase scsi_transport_spi [last unloaded: speedstep_lib]

Pid: 1665, comm: flush-0:22 Not tainted 2.6.32-356-test-2 #2 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffff81282e78>]  [<ffffffff81282e78>] memcpy+0x18/0x120
RSP: 0018:ffff88003dfab588  EFLAGS: 00010206
RAX: ffff88003dc42000 RBX: ffff88003dfab610 RCX: 0000000000000009
RDX: 000000003f807ff0 RSI: 0000000000008050 RDI: ffff88003dc42000
RBP: ffff88003dfab5b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000080 R12: 0000000000000024
R13: ffff88003dc42000 R14: ffff88003f808030 R15: ffff88003dfab6a0
FS:  0000000000000000(0000) GS:ffff880003420000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000008050 CR3: 000000003bc92000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process flush-0:22 (pid: 1665, threadinfo ffff88003dfaa000, task ffff880037f77540)
Stack:
ffffffffa0398ac1 ffff8800397c5940 ffff88003dfab610 ffff88003dfab6a0
<d> ffff88003dfab5d0 ffff88003dfab680 ffffffffa01c150b ffffea0000d82e70
<d> 000000508116713b 0000000000000000 0000000000000000 0000000000000000
Call Trace:
[<ffffffffa0398ac1>] ? xdr_inline_decode+0xb1/0x120 [sunrpc]
[<ffffffffa01c150b>] filelayout_decode_layout+0xeb/0x350 [nfs_layout_nfsv41_files]
[<ffffffffa01c17fc>] filelayout_alloc_lseg+0x8c/0x3c0 [nfs_layout_nfsv41_files]
[<ffffffff8150e6ce>] ? __wait_on_bit+0x7e/0x90

Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org
2013-02-17 15:24:16 -05:00
..
blocklayout NFSv4.1: Move slot table and session struct definitions to nfs4session.h 2012-12-06 00:30:46 +01:00
objlayout NFSv4.1: Remove unused function last_byte_offset 2012-11-04 14:43:38 -05:00
cache_lib.c NFSv4: Get rid of unnecessary BUG_ON()s 2012-11-04 14:43:39 -05:00
cache_lib.h
callback_proc.c NFSv4.1: Fix bulk recall and destroy of layouts 2013-02-14 13:22:50 -05:00
callback_xdr.c NFSv4.1: Move slot table and session struct definitions to nfs4session.h 2012-12-06 00:30:46 +01:00
callback.c NFSv4: Fix the return value for nfs_callback_start_svc 2012-10-16 13:14:42 -04:00
callback.h NFSv4.1: Clean up session draining 2012-12-06 00:30:44 +01:00
client.c NFS: avoid NULL dereference in nfs_destroy_server 2012-12-12 23:55:56 -05:00
delegation.c NFSv4: Ensure delegation recall and byte range lock removal don't conflict 2013-02-11 15:33:13 -05:00
delegation.h NFSv4.1: Don't lose locks when a server reboots during delegation return 2013-02-11 15:33:12 -05:00
dir.c NFS: Fix access to suid/sgid executables 2013-01-03 17:06:27 -05:00
direct.c nfs: fix page dirtying in NFS DIO read codepath 2012-12-12 12:56:19 -05:00
dns_resolve.c NFS: fix bug in legacy DNS resolver. 2012-10-31 16:25:59 -04:00
dns_resolve.h
file.c lseek: the "whence" argument is called "whence" 2012-12-17 17:15:12 -08:00
fscache-index.c
fscache.c NFS4: Open files for fscaching 2012-12-20 22:19:42 +00:00
fscache.h NFS: Provide stub nfs_fscache_wait_on_invalidate() for when CONFIG_NFS_FSCACHE=n 2012-12-21 08:06:48 -08:00
getroot.c
idmap.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2012-12-16 15:40:50 -08:00
inode.c Revert "NFS: add nfs_sb_deactive_async to avoid deadlock" 2013-02-01 10:13:48 -05:00
internal.h Revert "NFS: add nfs_sb_deactive_async to avoid deadlock" 2013-02-01 10:13:48 -05:00
iostat.h
Kconfig
Makefile NFSv4.1: Cleanup move session slot management to fs/nfs/nfs4session.c 2012-12-06 00:30:45 +01:00
mount_clnt.c NFS: Remove the BUG_ON() in the mount code 2012-11-04 14:43:39 -05:00
namespace.c NFS: Don't silently fail setattr() requests on mountpoints 2013-01-30 17:41:04 -05:00
netns.h
nfs2super.c
nfs2xdr.c NFS: Remove asserts from the NFS XDR code 2012-11-04 14:43:38 -05:00
nfs3acl.c
nfs3client.c
nfs3proc.c SUNRPC handle EKEYEXPIRED in call_refreshresult 2012-12-12 15:36:02 -05:00
nfs3super.c
nfs3xdr.c NFS: Remove asserts from the NFS XDR code 2012-11-04 14:43:38 -05:00
nfs4_fs.h NFSv4: Ensure delegation recall and byte range lock removal don't conflict 2013-02-11 15:33:13 -05:00
nfs4client.c NFSv4.1: Ensure that nfs41_walk_client_list() does start lease recovery 2013-01-27 15:51:41 -05:00
nfs4file.c NFS4: Open files for fscaching 2012-12-20 22:19:42 +00:00
nfs4filelayout.c SUNRPC handle EKEYEXPIRED in call_refreshresult 2012-12-12 15:36:02 -05:00
nfs4filelayout.h NFSv4.1: Kill nfs4_ds_disconnect() 2012-10-15 10:49:42 -04:00
nfs4filelayoutdev.c NFSv4.1: Cleanup move session slot management to fs/nfs/nfs4session.c 2012-12-06 00:30:45 +01:00
nfs4getroot.c NFSv4: fs/nfs/nfs4getroot.c needs to include "internal.h" 2012-10-16 12:37:59 -04:00
nfs4namespace.c nfs: Show original device name verbatim in /proc/*/mount{s,info} 2012-10-31 16:26:26 -04:00
nfs4proc.c NFSv4.1: Don't decode skipped layoutgets 2013-02-17 15:24:16 -05:00
nfs4renewd.c
nfs4session.c NFSv4.1: Deal effectively with interrupted RPC calls. 2012-12-15 15:39:59 -05:00
nfs4session.h NFSv4.1: Deal effectively with interrupted RPC calls. 2012-12-15 15:39:59 -05:00
nfs4state.c NFSv4: Ensure delegation recall and byte range lock removal don't conflict 2013-02-11 15:33:13 -05:00
nfs4super.c NFS: Ensure that we always drop inodes that have been marked as stale 2012-12-14 14:36:36 -05:00
nfs4sysctl.c
nfs4xdr.c Merge branch 'bugfixes' into nfs-for-next 2012-12-11 09:16:26 -05:00
nfs.h
nfsroot.c
pagelist.c
pnfs_dev.c
pnfs.c NFSv4.1: Fix bulk recall and destroy of layouts 2013-02-14 13:22:50 -05:00
pnfs.h NFSv4.1: Fix bulk recall and destroy of layouts 2013-02-14 13:22:50 -05:00
proc.c SUNRPC handle EKEYEXPIRED in call_refreshresult 2012-12-12 15:36:02 -05:00
read.c NFS: Ensure that we free the rpc_task after read and write cleanups are done 2013-01-04 12:59:10 -05:00
super.c Revert "NFS: add nfs_sb_deactive_async to avoid deadlock" 2013-02-01 10:13:48 -05:00
symlink.c
sysctl.c
unlink.c Revert "NFS: add nfs_sb_deactive_async to avoid deadlock" 2013-02-01 10:13:48 -05:00
write.c NFS: Ensure that we free the rpc_task after read and write cleanups are done 2013-01-04 12:59:10 -05:00