lkml.org 
[lkml]   [2018]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: NFSd: NULL-dereference when writing to v4_end_grace when server is not yet started
On Tue, Nov 27, 2018 at 03:58:49PM -0500, J. Bruce Fields wrote:
> On Sun, Nov 25, 2018 at 09:17:10AM +0300, Anatoly Trosinenko wrote:
> > When manually exploring the kernel NFSd feature, I have stumbled upon
> > a NULL-dereference when writing to v4_end_grace when server is not yet
> > started.
>
> Thanks for the report!
>
> I think this is what we want--it's what a lot of the other nfsctl
> methods do.

Hm, no, I'm getting a hang. It looks like in the nfsd4 state startup we
call a cltrack upcall while holding the nfsd_mutex, then nfsdcltrack
tries to write to end_grace. That's kind of ugly.

--b.

> commit ad5fdf47b4e3
> Author: J. Bruce Fields <bfields@redhat.com>
> Date: Tue Nov 27 15:54:17 2018 -0500
>
> nfsd4: fix crash on writing v4_end_grace before nfsd startup
>
> Anatoly Trosinenko reports that this:
>
> 1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
> 2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
> 3) From `kvm-xfstests shell`:
>
> results in NULL dereference in locks_end_grace.
>
> Check that nfsd has been started before trying to end the grace period.
>
> Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
>
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 6384c9b94898..38b223c1378e 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -1126,7 +1126,13 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
> case 'Y':
> case 'y':
> case '1':
> + mutex_lock(&nfsd_mutex);
> + if (nn->nfsd_serv) {
> + mutex_unlock(&nfsd_mutex);
> + return -EBUSY;
> + }
> nfsd4_end_grace(nn);
> + mutex_unlock(&nfsd_mutex);
> break;
> default:
> return -EINVAL;

\
 
 \ /
  Last update: 2018-11-28 02:19    [W:0.056 / U:3.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site