From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Stanislav Kinsbursky <skinsbursky@parallels.com>,
Jeff Layton <jlayton@redhat.com>,
"J. Bruce Fields" <bfields@redhat.com>,
Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 30/78] nfsd: fix oops when legacy_recdir_name_error is passed a -ENOENT error
Date: Tue, 28 May 2013 14:19:39 -0700 [thread overview]
Message-ID: <1369776027-17859-31-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1369776027-17859-1-git-send-email-kamal@canonical.com>
3.8.13.1 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@redhat.com>
commit 7255e716b1757dc10fa5e3a4d2eaab303ff9f7b6 upstream.
Toralf reported the following oops to the linux-nfs mailing list:
-----------------[snip]------------------
NFSD: unable to generate recoverydir name (-2).
NFSD: disabling legacy clientid tracking. Reboot recovery will not function correctly!
BUG: unable to handle kernel NULL pointer dereference at 000003c8
IP: [<f90a3d91>] nfsd4_client_tracking_exit+0x11/0x50 [nfsd]
*pdpt = 000000002ba33001 *pde = 0000000000000000
Oops: 0000 [#1] SMP
Modules linked in: loop nfsd auth_rpcgss ipt_MASQUERADE xt_owner xt_multiport ipt_REJECT xt_tcpudp xt_recent xt_conntrack nf_conntrack_ftp xt_limit xt_LOG iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_filter ip_tables x_tables af_packet pppoe pppox ppp_generic slhc bridge stp llc tun arc4 iwldvm mac80211 coretemp kvm_intel uvcvideo sdhci_pci sdhci mmc_core videobuf2_vmalloc videobuf2_memops usblp videobuf2_core i915 iwlwifi psmouse videodev cfg80211 kvm fbcon bitblit cfbfillrect acpi_cpufreq mperf evdev softcursor font cfbimgblt i2c_algo_bit cfbcopyarea intel_agp intel_gtt drm_kms_helper snd_hda_codec_conexant drm agpgart fb fbdev tpm_tis thinkpad_acpi tpm nvram e1000e rfkill thermal ptp wmi pps_core tpm_bios 8250_pci processor 8250 ac snd_hda_intel snd_hda_codec snd_pcm battery video i2c_i801 snd_page_alloc snd_timer button serial_core i2c_core snd soundcore thermal_sys hwmon aesni_intel ablk_helper cryp
td lrw aes_i586 xts gf128mul cbc fuse nfs lockd sunrpc dm_crypt dm_mod hid_monterey hid_microsoft hid_logitech hid_ezkey hid_cypress hid_chicony hid_cherry hid_belkin hid_apple hid_a4tech hid_generic usbhid hid sr_mod cdrom sg [last unloaded: microcode]
Pid: 6374, comm: nfsd Not tainted 3.9.1 #6 LENOVO 4180F65/4180F65
EIP: 0060:[<f90a3d91>] EFLAGS: 00010202 CPU: 0
EIP is at nfsd4_client_tracking_exit+0x11/0x50 [nfsd]
EAX: 00000000 EBX: fffffffe ECX: 00000007 EDX: 00000007
ESI: eb9dcb00 EDI: eb2991c0 EBP: eb2bde38 ESP: eb2bde34
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 80050033 CR2: 000003c8 CR3: 2ba80000 CR4: 000407f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process nfsd (pid: 6374, ti=eb2bc000 task=eb2711c0 task.ti=eb2bc000)
Stack:
fffffffe eb2bde4c f90a3e0c f90a7754 fffffffe eb0a9c00 eb2bdea0 f90a41ed
eb2991c0 1b270000 eb2991c0 eb2bde7c f9099ce9 eb2bde98 0129a020 eb29a020
eb2bdecc eb2991c0 eb2bdea8 f9099da5 00000000 eb9dcb00 00000001 67822f08
Call Trace:
[<f90a3e0c>] legacy_recdir_name_error+0x3c/0x40 [nfsd]
[<f90a41ed>] nfsd4_create_clid_dir+0x15d/0x1c0 [nfsd]
[<f9099ce9>] ? nfsd4_lookup_stateid+0x99/0xd0 [nfsd]
[<f9099da5>] ? nfs4_preprocess_seqid_op+0x85/0x100 [nfsd]
[<f90a4287>] nfsd4_client_record_create+0x37/0x50 [nfsd]
[<f909d6ce>] nfsd4_open_confirm+0xfe/0x130 [nfsd]
[<f90980b1>] ? nfsd4_encode_operation+0x61/0x90 [nfsd]
[<f909d5d0>] ? nfsd4_free_stateid+0xc0/0xc0 [nfsd]
[<f908fd0b>] nfsd4_proc_compound+0x41b/0x530 [nfsd]
[<f9081b7b>] nfsd_dispatch+0x8b/0x1a0 [nfsd]
[<f857b85d>] svc_process+0x3dd/0x640 [sunrpc]
[<f908165d>] nfsd+0xad/0x110 [nfsd]
[<f90815b0>] ? nfsd_destroy+0x70/0x70 [nfsd]
[<c1054824>] kthread+0x94/0xa0
[<c1486937>] ret_from_kernel_thread+0x1b/0x28
[<c1054790>] ? flush_kthread_work+0xd0/0xd0
Code: 86 b0 00 00 00 90 c5 0a f9 c7 04 24 70 76 0a f9 e8 74 a9 3d c8 eb ba 8d 76 00 55 89 e5 53 66 66 66 66 90 8b 15 68 c7 0a f9 85 d2 <8b> 88 c8 03 00 00 74 2c 3b 11 77 28 8b 5c 91 08 85 db 74 22 8b
EIP: [<f90a3d91>] nfsd4_client_tracking_exit+0x11/0x50 [nfsd] SS:ESP 0068:eb2bde34
CR2: 00000000000003c8
---[ end trace 09e54015d145c9c6 ]---
The problem appears to be a regression that was introduced in commit
9a9c6478 "nfsd: make NFSv4 recovery client tracking options per net".
Prior to that commit, it was safe to pass a NULL net pointer to
nfsd4_client_tracking_exit in the legacy recdir case, and
legacy_recdir_name_error did so. After that comit, the net pointer must
be valid.
This patch just fixes legacy_recdir_name_error to pass in a valid net
pointer to that function.
Cc: Stanislav Kinsbursky <skinsbursky@parallels.com>
Reported-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/nfsd/nfs4recover.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index ba6fdd4..25e53d8 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -146,7 +146,7 @@ out_no_tfm:
* then disable recovery tracking.
*/
static void
-legacy_recdir_name_error(int error)
+legacy_recdir_name_error(struct nfs4_client *clp, int error)
{
printk(KERN_ERR "NFSD: unable to generate recoverydir "
"name (%d).\n", error);
@@ -159,9 +159,7 @@ legacy_recdir_name_error(int error)
if (error == -ENOENT) {
printk(KERN_ERR "NFSD: disabling legacy clientid tracking. "
"Reboot recovery will not function correctly!\n");
-
- /* the argument is ignored by the legacy exit function */
- nfsd4_client_tracking_exit(NULL);
+ nfsd4_client_tracking_exit(clp->net);
}
}
@@ -184,7 +182,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
if (status)
- return legacy_recdir_name_error(status);
+ return legacy_recdir_name_error(clp, status);
status = nfs4_save_creds(&original_cred);
if (status < 0)
@@ -341,7 +339,7 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
if (status)
- return legacy_recdir_name_error(status);
+ return legacy_recdir_name_error(clp, status);
status = mnt_want_write_file(nn->rec_file);
if (status)
@@ -601,7 +599,7 @@ nfsd4_check_legacy_client(struct nfs4_client *clp)
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
if (status) {
- legacy_recdir_name_error(status);
+ legacy_recdir_name_error(clp, status);
return status;
}
--
1.8.1.2
next prev parent reply other threads:[~2013-05-28 21:24 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-28 21:19 [ 3.8.y.z extended stable ] Linux 3.8.13.1 stable review Kamal Mostafa
2013-05-28 21:19 ` [PATCH 01/78] drm/i915: Revert hdmi HDP pin checks Kamal Mostafa
2013-05-28 21:19 ` [PATCH 02/78] ARM: S5PV210: Fix PL330 DMA controller clkdev entries Kamal Mostafa
2013-05-28 21:19 ` [PATCH 03/78] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_lock_delegation_recall Kamal Mostafa
2013-05-28 21:19 ` [PATCH 04/78] blkcg: fix "scheduling while atomic" in blk_queue_bypass_start Kamal Mostafa
2013-05-28 21:19 ` [PATCH 05/78] audit: Syscall rules are not applied to existing processes on non-x86 Kamal Mostafa
2013-05-28 21:19 ` [PATCH 06/78] menuconfig: Fix memory leak introduced by jump keys feature Kamal Mostafa
2013-05-28 21:19 ` [PATCH 07/78] iommu/amd: Workaround for ERBT1312 Kamal Mostafa
2013-05-28 21:19 ` [PATCH 08/78] drivers/rtc/rtc-at91rm9200.c: fix missing iounmap Kamal Mostafa
2013-05-28 21:19 ` [PATCH 09/78] drm/mm: fix dump table BUG Kamal Mostafa
2013-05-28 21:19 ` [PATCH 10/78] ASoC: wm8994: missing break in wm8994_aif3_hw_params() Kamal Mostafa
2013-05-28 21:19 ` [PATCH 11/78] tile: support new Tilera hypervisor Kamal Mostafa
2013-05-28 21:19 ` [PATCH 12/78] [SCSI] sd: fix array cache flushing bug causing performance problems Kamal Mostafa
2013-05-28 21:19 ` [PATCH 13/78] ath9k: fix key allocation error handling for powersave keys Kamal Mostafa
2013-05-28 21:19 ` [PATCH 14/78] target: Use FD_MAX_SECTORS/FD_BLOCKSIZE for blockdevs using fileio Kamal Mostafa
2013-05-28 21:19 ` [PATCH 15/78] ext4: limit group search loop for non-extent files Kamal Mostafa
2013-05-28 21:19 ` [PATCH 16/78] xen/vcpu/pvhvm: Fix vcpu hotplugging hanging Kamal Mostafa
2013-05-28 21:19 ` [PATCH 17/78] ALSA: HDA: Fix Oops caused by dereference NULL pointer Kamal Mostafa
2013-05-28 21:19 ` [PATCH 18/78] iscsi-target: Fix processing of OOO commands Kamal Mostafa
2013-05-28 21:19 ` [PATCH 19/78] audit: vfs: fix audit_inode call in O_CREAT case of do_last Kamal Mostafa
2013-05-28 21:19 ` [PATCH 20/78] ACPICA: Fix possible buffer overflow during a field unit read operation Kamal Mostafa
2013-05-28 21:19 ` [PATCH 21/78] qmi_wwan, cdc-ether: add ADU960S Kamal Mostafa
2013-05-28 21:19 ` [PATCH 22/78] qmi_wwan/cdc_ether: add device IDs for Dell 5804 (Novatel E371) WWAN card Kamal Mostafa
2013-05-28 21:19 ` [PATCH 23/78] B43: Handle DMA RX descriptor underrun Kamal Mostafa
2013-05-28 21:19 ` [PATCH 24/78] mwifiex: clear is_suspended flag when interrupt is received early Kamal Mostafa
2013-05-28 21:19 ` [PATCH 25/78] mwifiex: fix memory leak issue when driver unload Kamal Mostafa
2013-05-28 21:19 ` [PATCH 26/78] mwifiex: fix setting of multicast filter Kamal Mostafa
2013-05-28 21:19 ` [PATCH 27/78] ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices Kamal Mostafa
2013-05-28 21:19 ` [PATCH 28/78] hp_accel: Ignore the error from lis3lv02d_poweron() at resume Kamal Mostafa
2013-05-28 21:19 ` [PATCH 29/78] KVM: VMX: fix halt emulation while emulating invalid guest sate Kamal Mostafa
2013-05-28 21:19 ` Kamal Mostafa [this message]
2013-05-28 21:19 ` [PATCH 31/78] shm: fix null pointer deref when userspace specifies invalid hugepage size Kamal Mostafa
2013-05-28 21:19 ` [PATCH 32/78] dm stripe: fix regression in stripe_width calculation Kamal Mostafa
2013-05-28 21:19 ` [PATCH 33/78] dm snapshot: fix error return code in snapshot_ctr Kamal Mostafa
2013-05-28 21:19 ` [PATCH 34/78] mm: teach mm by current context info to not do I/O during memory allocation Kamal Mostafa
2013-05-28 21:19 ` [PATCH 35/78] dm bufio: avoid a possible __vmalloc deadlock Kamal Mostafa
2013-05-28 21:19 ` [PATCH 36/78] dm table: fix write same support Kamal Mostafa
2013-05-28 21:19 ` [PATCH 37/78] tick: Cleanup NOHZ per cpu data on cpu down Kamal Mostafa
2013-05-28 21:19 ` [PATCH 38/78] ACPI / EC: Restart transaction even when the IBF flag set Kamal Mostafa
2013-05-28 21:19 ` [PATCH 39/78] drm/mgag200: Fix writes into MGA1064_PIX_CLK_CTL register Kamal Mostafa
2013-05-28 21:19 ` [PATCH 40/78] drm/mgag200: Fix framebuffer base address programming Kamal Mostafa
2013-05-28 21:19 ` [PATCH 41/78] drm/radeon: check incoming cliprects pointer Kamal Mostafa
2013-05-28 21:19 ` [PATCH 42/78] arm64: debug: clear mdscr_el1 instead of taking the OS lock Kamal Mostafa
2013-05-28 21:19 ` [PATCH 43/78] ARM: 7720/1: ARM v6/v7 cmpxchg64 shouldn't clear upper 32 bits of the old/new value Kamal Mostafa
2013-05-28 21:19 ` [PATCH 44/78] powerpc/kexec: Fix kexec when using VMX optimised memcpy Kamal Mostafa
2013-05-28 21:19 ` [PATCH 45/78] powerpc: Bring all threads online prior to migration/hibernation Kamal Mostafa
2013-05-28 21:19 ` [PATCH 46/78] arm64: mm: Fix operands of clz in __flush_dcache_all Kamal Mostafa
2013-05-28 21:19 ` [PATCH 47/78] timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE Kamal Mostafa
2013-05-28 21:19 ` [PATCH 48/78] target: close target_put_sess_cmd() vs. core_tmr_abort_task() race Kamal Mostafa
2013-05-28 21:19 ` [PATCH 49/78] tracing: Fix leaks of filter preds Kamal Mostafa
2013-05-28 21:19 ` [PATCH 50/78] usermodehelper: check subprocess_info->path != NULL Kamal Mostafa
2013-05-28 21:20 ` [PATCH 51/78] drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow Kamal Mostafa
2013-05-28 21:20 ` [PATCH 52/78] ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex Kamal Mostafa
2013-05-28 21:20 ` [PATCH 53/78] btrfs: don't stop searching after encountering the wrong item Kamal Mostafa
2013-05-28 21:20 ` [PATCH 54/78] watchdog: Fix race condition in registration code Kamal Mostafa
2013-05-28 21:20 ` [PATCH 55/78] pch_dma: Use GFP_ATOMIC because called from interrupt context Kamal Mostafa
2013-05-28 21:20 ` [PATCH 56/78] ARM: EXYNOS5: Fix kernel dump in AFTR idle mode Kamal Mostafa
2013-05-28 21:20 ` [PATCH 57/78] drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe() Kamal Mostafa
2013-05-28 21:20 ` [PATCH 58/78] tcp: force a dst refcount when prequeue packet Kamal Mostafa
2013-05-28 21:20 ` [PATCH 59/78] sfc: Fix naming of MTD partitions for FPGA bitfiles Kamal Mostafa
2013-05-28 21:20 ` [PATCH 60/78] net: tun: release the reference of tun device in tun_recvmsg Kamal Mostafa
2013-05-28 21:20 ` [PATCH 61/78] net: mac802154: comparision issue of type cast, finding by EXTRA_CFLAGS=-W Kamal Mostafa
2013-05-28 21:20 ` [PATCH 62/78] tcp: reset timer after any SYNACK retransmit Kamal Mostafa
2013-05-28 21:20 ` [PATCH 63/78] 3c509.c: call SET_NETDEV_DEV for all device types (ISA/ISAPnP/EISA) Kamal Mostafa
2013-05-28 21:20 ` [PATCH 64/78] net_sched: act_ipt forward compat with xtables Kamal Mostafa
2013-05-28 21:20 ` [PATCH 65/78] net: use netdev_features_t in skb_needs_linearize() Kamal Mostafa
2013-05-28 21:20 ` [PATCH 66/78] net: vlan,ethtool: netdev_features_t is more than 32 bit Kamal Mostafa
2013-05-28 21:20 ` [PATCH 67/78] bridge: fix race with topology change timer Kamal Mostafa
2013-05-28 21:20 ` [PATCH 68/78] packet: tpacket_v3: do not trigger bug() on wrong header status Kamal Mostafa
2013-05-28 21:20 ` [PATCH 69/78] virtio: don't expose u16 in userspace api Kamal Mostafa
2013-05-28 21:20 ` [PATCH 70/78] 3c59x: fix freeing nonexistent resource on driver unload Kamal Mostafa
2013-05-28 21:20 ` [PATCH 71/78] 3c59x: fix PCI resource management Kamal Mostafa
2013-05-28 21:20 ` [PATCH 72/78] if_cablemodem.h: Add parenthesis around ioctl macros Kamal Mostafa
2013-05-28 21:20 ` [PATCH 73/78] macvlan: fix passthru mode race between dev removal and rx path Kamal Mostafa
2013-05-28 21:20 ` [PATCH 74/78] ipv6: do not clear pinet6 field Kamal Mostafa
2013-05-28 21:20 ` [PATCH 75/78] ipv6,gre: do not leak info to user-space Kamal Mostafa
2013-05-28 21:20 ` [PATCH 76/78] xfrm6: release dev before returning error Kamal Mostafa
2013-05-28 21:20 ` [PATCH 77/78] drm/i915: add HAS_DDI check Kamal Mostafa
2013-05-28 21:20 ` [PATCH 78/78] drm/i915: don't intel_crt_init on any ULT machines Kamal Mostafa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1369776027-17859-31-git-send-email-kamal@canonical.com \
--to=kamal@canonical.com \
--cc=bfields@redhat.com \
--cc=jlayton@redhat.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=skinsbursky@parallels.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®