linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Serge E. Hallyn" <serue@us.ibm.com>
To: Cedric Le Goater <clg@fr.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Trond Myklebust <trond.myklebust@fys.uio.no>,
	Chuck Lever <chuck.lever@oracle.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Linux Containers <containers@lists.osdl.org>,
	linux-nfs@vger.kernel.org
Subject: Re: [RFC][PATCH] sunrpc: fix oops in rpc_create() when the mount namespace is unshared
Date: Tue, 9 Sep 2008 07:43:11 -0500	[thread overview]
Message-ID: <20080909124311.GA10053@us.ibm.com> (raw)
In-Reply-To: <48C52B29.4020204@fr.ibm.com>

Quoting Cedric Le Goater (clg@fr.ibm.com):
> On a system with nfs mounts, if a task unshares its mount namespace,
> a oops can occur when the system is rebooted if the task is the last
> to unreference the nfs mount. It will try to create a rpc request
> using utsname() which has been invalidated by free_nsproxy().
> 
> The patch fixes the issue by using the global init_utsname() but at
> the same time, it breaks the capability of identifying rpc clients
> per uts namespace.
> 
> Any better suggestions ?
> 
> BUG: unable to handle kernel NULL pointer dereference at 00000004
> IP: [<c024c9ab>] rpc_create+0x332/0x42f
> Oops: 0000 [#1] DEBUG_PAGEALLOC
> 
> Pid: 1857, comm: uts-oops Not tainted (2.6.27-rc5-00319-g7686ad5 #4)
> EIP: 0060:[<c024c9ab>] EFLAGS: 00210287 CPU: 0
> EIP is at rpc_create+0x332/0x42f
> EAX: 00000000 EBX: df26adf0 ECX: c0251887 EDX: 00000001
> ESI: df26ae58 EDI: c02f293c EBP: dda0fc9c ESP: dda0fc2c
>  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
> Process uts-oops (pid: 1857, ti=dda0e000 task=dd9a0778 task.ti=dda0e000)
> Stack: c0104532 dda0fffc dda0fcac dda0e000 dda0e000 dd93b7f0 00000009 c02f2880
>        df26aefc dda0fc68 c01096b7 00000000 c0266ee0 c039a070 c039a070 dda0fc74
>        c012ca67 c039a064 dda0fc8c c012cb20 c03daf74 00000011 00000000 c0275c90
> Call Trace:
>  [<c0104532>] ? dump_trace+0xc2/0xe2
>  [<c01096b7>] ? save_stack_trace+0x1c/0x3a
>  [<c012ca67>] ? save_trace+0x37/0x8c
>  [<c012cb20>] ? add_lock_to_list+0x64/0x96
>  [<c0256fc4>] ? rpcb_register_call+0x62/0xbb
>  [<c02570c8>] ? rpcb_register+0xab/0xb3
>  [<c0252f4d>] ? svc_register+0xb4/0x128
>  [<c0253114>] ? svc_destroy+0xec/0x103
>  [<c02531b2>] ? svc_exit_thread+0x87/0x8d
>  [<c01a75cd>] ? lockd_down+0x61/0x81
>  [<c01a577b>] ? nlmclnt_done+0xd/0xf
>  [<c01941fe>] ? nfs_destroy_server+0x14/0x16
>  [<c0194328>] ? nfs_free_server+0x4c/0xaa
>  [<c019a066>] ? nfs_kill_super+0x23/0x27
>  [<c0158585>] ? deactivate_super+0x3f/0x51
>  [<c01695d1>] ? mntput_no_expire+0x95/0xb4
>  [<c016965b>] ? release_mounts+0x6b/0x7a
>  [<c01696cc>] ? __put_mnt_ns+0x62/0x70
>  [<c0127501>] ? free_nsproxy+0x25/0x80
>  [<c012759a>] ? switch_task_namespaces+0x3e/0x43
>  [<c01275a9>] ? exit_task_namespaces+0xa/0xc
>  [<c0117fed>] ? do_exit+0x4fd/0x666
>  [<c01181b3>] ? do_group_exit+0x5d/0x83
>  [<c011fa8c>] ? get_signal_to_deliver+0x2c8/0x2e0
>  [<c0102630>] ? do_notify_resume+0x69/0x700
>  [<c011d85a>] ? do_sigaction+0x134/0x145
>  [<c0127205>] ? hrtimer_nanosleep+0x8f/0xce
>  [<c0126d1a>] ? hrtimer_wakeup+0x0/0x1c
>  [<c0103488>] ? work_notifysig+0x13/0x1b
>  =======================
> Code: 70 20 68 cb c1 2c c0 e8 75 4e 01 00 8b 83 ac 00 00 00 59 3d 00 f0 ff ff 5f 77 63 eb 57 a1 00 80 2d c0 8b 80 a8 02 00 00 8d 73 68 <8b> 40 04 83 c0 45 e8 41 46 f7 ff ba 20 00 00 00 83 f8 21 0f 4c
> EIP: [<c024c9ab>] rpc_create+0x332/0x42f SS:ESP 0068:dda0fc2c
> 
> Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>

Thanks, Cedric.  Eric is probably right about the long-term fix, but
yeah it might take a while to properly wade through the sunrpc and nfs
layers to store the nodename at nfs mount time, and in the meantime this
fixes a real oops.

Acked-by: Serge Hallyn <serue@us.ibm.com>

> ---
>  net/sunrpc/clnt.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
> index 76739e9..a59cdf4 100644
> --- a/net/sunrpc/clnt.c
> +++ b/net/sunrpc/clnt.c
> @@ -213,10 +213,10 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
>  	}
> 
>  	/* save the nodename */
> -	clnt->cl_nodelen = strlen(utsname()->nodename);
> +	clnt->cl_nodelen = strlen(init_utsname()->nodename);
>  	if (clnt->cl_nodelen > UNX_MAXNODENAME)
>  		clnt->cl_nodelen = UNX_MAXNODENAME;
> -	memcpy(clnt->cl_nodename, utsname()->nodename, clnt->cl_nodelen);
> +	memcpy(clnt->cl_nodename, init_utsname()->nodename, clnt->cl_nodelen);
>  	rpc_register_client(clnt);
>  	return clnt;
> 
> -- 
> 1.5.5.1

  parent reply	other threads:[~2008-09-09 12:43 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-09-08 13:39 [RFC][PATCH] sunrpc: fix oops in rpc_create() when the mount namespace is unshared Cedric Le Goater
2008-09-08 15:19 ` Serge E. Hallyn
2008-09-08 15:27   ` Serge E. Hallyn
2008-09-08 15:37   ` Cedric Le Goater
2008-09-08 15:43     ` Serge E. Hallyn
2008-09-08 16:09 ` Eric W. Biederman
2008-09-09 11:54   ` Cedric Le Goater
2008-09-09 12:43 ` Serge E. Hallyn [this message]
2008-09-09 15:09   ` Eric W. Biederman
2008-09-09 15:29     ` Serge E. Hallyn
2008-09-09 15:40       ` Cedric Le Goater
2008-09-09 17:07       ` Chuck Lever
2008-09-09 18:20         ` Eric W. Biederman
2008-09-09 19:00           ` Chuck Lever
2008-09-09 20:08             ` Eric W. Biederman
2008-09-10  9:23           ` Cedric Le Goater
2008-09-10 15:12             ` Chuck Lever
2008-09-10 20:02               ` Eric W. Biederman
2008-09-10 20:54                 ` Chuck Lever
2008-09-11  9:02                 ` Cedric Le Goater
2008-09-11 10:27                   ` Eric W. Biederman
2008-09-11 16:39                   ` Chuck Lever

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20080909124311.GA10053@us.ibm.com \
    --to=serue@us.ibm.com \
    --cc=akpm@linux-foundation.org \
    --cc=chuck.lever@oracle.com \
    --cc=clg@fr.ibm.com \
    --cc=containers@lists.osdl.org \
    --cc=ebiederm@xmission.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-nfs@vger.kernel.org \
    --cc=trond.myklebust@fys.uio.no \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).