From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE51BC3A59C for ; Fri, 16 Aug 2019 17:37:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8D6AB205F4 for ; Fri, 16 Aug 2019 17:37:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727466AbfHPRh0 (ORCPT ); Fri, 16 Aug 2019 13:37:26 -0400 Received: from fieldses.org ([173.255.197.46]:35828 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727286AbfHPRhZ (ORCPT ); Fri, 16 Aug 2019 13:37:25 -0400 Received: by fieldses.org (Postfix, from userid 2815) id C4A921F01; Fri, 16 Aug 2019 13:37:24 -0400 (EDT) Date: Fri, 16 Aug 2019 13:37:24 -0400 From: "J. Bruce Fields" To: zhe.he@windriver.com Cc: chuck.lever@oracle.com, linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] nfsd4: Fix kernel crash when reading proc file reply_cache_stats Message-ID: <20190816173724.GC4234@fieldses.org> References: <1565084464-248436-1-git-send-email-zhe.he@windriver.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1565084464-248436-1-git-send-email-zhe.he@windriver.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org On Tue, Aug 06, 2019 at 05:41:04PM +0800, zhe.he@windriver.com wrote: > From: He Zhe > > reply_cache_stats uses wrong parameter as seq file private structure and > thus causes the following kernel crash when users read > /proc/fs/nfsd/reply_cache_stats Thanks, applying for 5.3. --b. > > BUG: kernel NULL pointer dereference, address: 00000000000001f9 > PGD 0 P4D 0 > Oops: 0000 [#3] SMP PTI > CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1 > Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015 > RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 > Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 > RSP: 0018:ffffaa520106fe08 EFLAGS: 00010246 > RAX: 000000cfe1a77123 RBX: 0000000000000000 RCX: 0000000000291b46 > RDX: 000000cf00000000 RSI: 0000000000000006 RDI: 0000000000291b28 > RBP: ffffaa520106fe20 R08: 0000000000000006 R09: 000000cfe17e55dd > R10: ffffa424e47c0000 R11: 000000000000030b R12: 0000000000000001 > R13: ffffa424e5697000 R14: 0000000000000001 R15: ffffa424e5697000 > FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 > Call Trace: > seq_read+0x194/0x3e0 > __vfs_read+0x1b/0x40 > vfs_read+0x95/0x140 > ksys_read+0x61/0xe0 > __x64_sys_read+0x1a/0x20 > do_syscall_64+0x4d/0x120 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > RIP: 0033:0x7f805728b861 > Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54 > RSP: 002b:00007ffea1ce3c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f805728b861 > RDX: 0000000000020000 RSI: 00007f8057183000 RDI: 0000000000000003 > RBP: 00007f8057183000 R08: 00007f8057182010 R09: 0000000000000000 > R10: 0000000000000022 R11: 0000000000000246 R12: 0000559a60e8ff10 > R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 > Modules linked in: > CR2: 00000000000001f9 > ---[ end trace 01613595153f0cba ]--- > RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 > Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 > RSP: 0018:ffffaa52004b3e08 EFLAGS: 00010246 > RAX: 0000002bab45a7c6 RBX: 0000000000000000 RCX: 0000000000291b4c > RDX: 0000002b00000000 RSI: 0000000000000004 RDI: 0000000000291b28 > RBP: ffffaa52004b3e20 R08: 0000000000000004 R09: 0000002bab1c8c7a > R10: ffffa424e5500000 R11: 00000000000002a9 R12: 0000000000000001 > R13: ffffa424e4475000 R14: 0000000000000001 R15: ffffa424e4475000 > FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 > Killed > > Fixes: 3ba75830ce17 ("nfsd4: drc containerization") > Signed-off-by: He Zhe > --- > fs/nfsd/nfscache.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c > index 26ad75a..96352ab 100644 > --- a/fs/nfsd/nfscache.c > +++ b/fs/nfsd/nfscache.c > @@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data) > */ > static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v) > { > - struct nfsd_net *nn = v; > + struct nfsd_net *nn = m->private; > > seq_printf(m, "max entries: %u\n", nn->max_drc_entries); > seq_printf(m, "num entries: %u\n", > -- > 2.7.4