Weston Andros Adamson 84febe04c5 NFSv4: fix NULL dereference in open recover ... commit f494a6071d upstream. _nfs4_opendata_reclaim_to_nfs4_state doesn't expect to see a cached open CLAIM_PREVIOUS, but this can happen. An example is when there are RDWR openers and RDONLY openers on a delegation stateid. The recovery path will first try an open CLAIM_PREVIOUS for the RDWR openers, this marks the delegation as not needing RECLAIM anymore, so the open CLAIM_PREVIOUS for the RDONLY openers will not actually send an rpc. The NULL dereference is due to _nfs4_opendata_reclaim_to_nfs4_state returning PTR_ERR(rpc_status) when !rpc_done. When the open is cached, rpc_done == 0 and rpc_status == 0, thus _nfs4_opendata_reclaim_to_nfs4_state returns NULL - this is unexpected by callers of nfs4_opendata_to_nfs4_state(). This can be reproduced easily by opening the same file two times on an NFSv4.0 mount with delegations enabled, once as RDWR and once as RDONLY then sleeping for a long time. While the files are held open, kick off state recovery and this NULL dereference will be hit every time. An example OOPS: [ 65.003602] BUG: unable to handle kernel NULL pointer dereference at 00000000 00000030 [ 65.005312] IP: [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4] [ 65.006820] PGD 7b0ea067 PUD 791ff067 PMD 0 [ 65.008075] Oops: 0000 [#1] SMP [ 65.008802] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache snd_ens1371 gameport nfsd snd_rawmidi snd_ac97_codec ac97_bus btusb snd_seq snd _seq_device snd_pcm ppdev bluetooth auth_rpcgss coretemp snd_page_alloc crc32_pc lmul crc32c_intel ghash_clmulni_intel microcode rfkill nfs_acl vmw_balloon serio _raw snd_timer lockd parport_pc e1000 snd soundcore parport i2c_piix4 shpchp vmw _vmci sunrpc ata_generic mperf pata_acpi mptspi vmwgfx ttm scsi_transport_spi dr m mptscsih mptbase i2c_core [ 65.018684] CPU: 0 PID: 473 Comm: 192.168.10.85-m Not tainted 3.11.2-201.fc19 .x86_64 #1 [ 65.020113] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 65.022012] task: ffff88003707e320 ti: ffff88007b906000 task.ti: ffff88007b906000 [ 65.023414] RIP: 0010:[<ffffffffa037d6ee>] [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4] [ 65.025079] RSP: 0018:ffff88007b907d10 EFLAGS: 00010246 [ 65.026042] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 65.027321] RDX: 0000000000000050 RSI: 0000000000000001 RDI: 0000000000000000 [ 65.028691] RBP: ffff88007b907d38 R08: 0000000000016f60 R09: 0000000000000000 [ 65.029990] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 65.031295] R13: 0000000000000050 R14: 0000000000000000 R15: 0000000000000001 [ 65.032527] FS: 0000000000000000(0000) GS:ffff88007f600000(0000) knlGS:0000000000000000 [ 65.033981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.035177] CR2: 0000000000000030 CR3: 000000007b27f000 CR4: 00000000000407f0 [ 65.036568] Stack: [ 65.037011] 0000000000000000 0000000000000001 ffff88007b907d90 ffff88007a880220 [ 65.038472] ffff88007b768de8 ffff88007b907d48 ffffffffa037e4a5 ffff88007b907d80 [ 65.039935] ffffffffa036a6c8 ffff880037020e40 ffff88007a880000 ffff880037020e40 [ 65.041468] Call Trace: [ 65.042050] [<ffffffffa037e4a5>] nfs4_close_state+0x15/0x20 [nfsv4] [ 65.043209] [<ffffffffa036a6c8>] nfs4_open_recover_helper+0x148/0x1f0 [nfsv4] [ 65.044529] [<ffffffffa036a886>] nfs4_open_recover+0x116/0x150 [nfsv4] [ 65.045730] [<ffffffffa036d98d>] nfs4_open_reclaim+0xad/0x150 [nfsv4] [ 65.046905] [<ffffffffa037d979>] nfs4_do_reclaim+0x149/0x5f0 [nfsv4] [ 65.048071] [<ffffffffa037e1dc>] nfs4_run_state_manager+0x3bc/0x670 [nfsv4] [ 65.049436] [<ffffffffa037de20>] ? nfs4_do_reclaim+0x5f0/0x5f0 [nfsv4] [ 65.050686] [<ffffffffa037de20>] ? nfs4_do_reclaim+0x5f0/0x5f0 [nfsv4] [ 65.051943] [<ffffffff81088640>] kthread+0xc0/0xd0 [ 65.052831] [<ffffffff81088580>] ? insert_kthread_work+0x40/0x40 [ 65.054697] [<ffffffff8165686c>] ret_from_fork+0x7c/0xb0 [ 65.056396] [<ffffffff81088580>] ? insert_kthread_work+0x40/0x40 [ 65.058208] Code: 5c 41 5d 5d c3 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 89 d5 41 54 53 48 89 fb <4c> 8b 67 30 f0 41 ff 44 24 44 49 8d 7c 24 40 e8 0e 0a 2d e1 44 [ 65.065225] RIP [<ffffffffa037d6ee>] __nfs4_close+0x1e/0x160 [nfsv4] [ 65.067175] RSP <ffff88007b907d10> [ 65.068570] CR2: 0000000000000030 [ 65.070098] ---[ end trace 0d1fe4f5c7dd6f8b ]--- Signed-off-by: Weston Andros Adamson <dros@netapp.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-11-29 11:11:48 -08:00
..
9p	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
adfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
affs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
afs	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
autofs4	autofs - remove autofs dentry mount check	2013-05-06 13:06:59 -07:00
befs	befs_readdir(): do not increment ->f_pos if filldir tells us to stop	2013-05-31 15:17:56 -04:00
bfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
btrfs	Btrfs: use right root when checking for hash collision	2013-10-18 07:45:44 -07:00
cachefiles	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
ceph	ceph: Don't forget the 'up_read(&osdc->map_sem)' if met error.	2013-09-26 17:18:29 -07:00
cifs	cifs: fix filp leak in cifs_atomic_open()	2013-10-01 09:17:45 -07:00
coda	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
configfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
cramfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
debugfs	debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)	2013-08-14 22:59:10 -07:00
devpts	fs: Limit sys_mount to only request filesystem modules (Part 2).	2013-03-07 01:08:55 -08:00
dlm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-05-01 14:08:52 -07:00
ecryptfs	ecryptfs: Fix memory leakage in keystore.c	2013-11-13 12:05:31 +09:00
efivarfs	efivarfs: Never return ENOENT from firmware again	2013-05-13 20:12:10 +01:00
efs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
exofs	block: Add bio_for_each_segment_all()	2013-03-23 14:26:28 -07:00
exportfs	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ext2	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
ext3	ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree()	2013-07-21 18:21:23 -07:00
ext4	ext4: fix memory leak in xattr	2013-10-18 07:45:44 -07:00
f2fs	f2fs updates for v3.10	2013-05-08 15:11:48 -07:00
fat	fat: fix possible overflow for fat_clusters	2013-05-24 16:22:50 -07:00
freevxfs	fs: Readd the fs module aliases.	2013-03-12 18:55:21 -07:00
fscache	fs/fscache/stats.c: fix memory leak	2013-04-29 15:54:27 -07:00
fuse	fuse: fix fallocate vs. ftruncate race	2013-10-13 16:08:32 -07:00
gfs2	GFS2: Don't cache iopen glocks	2013-06-03 16:40:22 +01:00
hfs	hfs: avoid crash in hfs_bnode_create	2013-05-24 16:22:51 -07:00
hfsplus	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
hostfs	hostfs: use kmalloc instead of kzalloc	2013-05-04 15:48:45 -04:00
hpfs	hpfs: better test for errors	2013-07-13 11:42:26 -07:00
hppfs	hppfs: get rid of ->fsync()	2013-04-29 15:41:42 -04:00
hugetlbfs	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-10-18 07:45:45 -07:00
isofs	isofs: Refuse RW mount of the filesystem instead of making it RO	2013-09-26 17:18:28 -07:00
jbd	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2013-05-03 09:56:25 -07:00
jbd2	jbd2: fix theoretical race in jbd2__journal_restart	2013-07-21 18:21:22 -07:00
jffs2	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
jfs	jfs: fix error path in ialloc	2013-11-13 12:05:31 +09:00
lockd	LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs	2013-08-14 22:59:08 -07:00
logfs	block: Remove bi_idx references	2013-03-23 14:15:31 -07:00
minix	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
ncpfs	ncpfs: fix rmdir returns Device or resource busy	2013-06-07 12:15:38 -04:00
nfs	NFSv4: fix NULL dereference in open recover	2013-11-29 11:11:48 -08:00
nfs_common	nfs_common: Update the translation between nfsv3 acls linux posix acls	2013-02-13 06:15:14 -08:00
nfsd	nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file	2013-08-04 16:50:57 +08:00
nilfs2	nilfs2: fix issue with race condition of competition between segments for dirty blocks	2013-10-13 16:08:32 -07:00
nls
notify	fanotify: info leak in copy_event_to_user()	2013-08-11 18:35:24 -07:00
ntfs	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
ocfs2	ocfs2: fix the end cluster offset of FIEMAP	2013-09-26 17:18:28 -07:00
omfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
openpromfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
proc	proc: Restrict mounting the proc filesystem	2013-09-26 17:18:28 -07:00
pstore	Couple of pstore cleanups	2013-05-09 16:42:10 -07:00
qnx4	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
qnx6	qnx6: qnx6_readdir() has a braino in pos calculation	2013-05-31 15:17:31 -04:00
quota	quota: add missing use of dq_data_lock in __dquot_initialize	2013-03-11 22:05:56 +01:00
ramfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-02-26 20:16:07 -08:00
reiserfs	reiserfs: fix deadlock in umount	2013-08-14 22:59:10 -07:00
romfs	romfs: fix nommu map length to keep inside filesystem	2013-04-29 09:17:57 +10:00
squashfs	fs: Limit sys_mount to only request filesystem modules. (Part 3)	2013-03-11 07:09:48 -07:00
sysfs	sysfs: check if one entry has been removed before freeing	2013-04-05 15:35:52 -07:00
sysv	sysv: Add forgotten superblock lock init for v7 fs	2013-10-05 07:13:09 -07:00
ubifs	UBIFS: correct mount message	2013-07-21 18:21:36 -07:00
udf	udf: Refuse RW mount of the filesystem instead of making it RO	2013-10-01 09:17:48 -07:00
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-04-30 09:36:50 -07:00
xfs	xfs: fix node forward in xfs_node_toosmall	2013-10-13 16:08:34 -07:00
aio.c	aio: fix io_destroy() regression by using call_rcu()	2013-06-12 16:29:46 -07:00
anon_inodes.c	get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero	2013-02-26 02:46:11 -05:00
attr.c
bad_inode.c
binfmt_aout.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
binfmt_elf_fdpic.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2013-05-02 10:16:16 -07:00
binfmt_elf.c	fs/binfmt_elf.c: prevent a coredump with a large vm_map_count from Oopsing	2013-10-13 16:08:31 -07:00
binfmt_em86.c
binfmt_flat.c	new helper: read_code()	2013-04-29 15:40:23 -04:00
binfmt_misc.c	binfmt_misc: reuse string_unescape_inplace()	2013-04-30 17:04:03 -07:00
binfmt_script.c
binfmt_som.c
bio-integrity.c	bio-integrity: Fix use of bs->bio_integrity_pool after free	2013-10-01 09:17:48 -07:00
bio.c	block: Fix bio_copy_data()	2013-10-05 07:13:09 -07:00
block_dev.c	writeback: Fix periodic writeback after fs mount	2013-07-28 16:29:40 -07:00
buffer.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c	Removed unused typedef to avoid "unused local typedef" warnings.	2013-05-04 15:03:05 -04:00
compat.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
coredump.c	do_coredump(): don't wait for thaw if coredump has already been interrupted	2013-05-04 14:45:54 -04:00
coredump.h
dcache.c	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-10-18 07:45:45 -07:00
dcookies.c	consolidate compat lookup_dcookie()	2013-03-03 23:00:23 -05:00
direct-io.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
drop_caches.c
eventfd.c
eventpoll.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2013-05-01 07:21:43 -07:00
exec.c	exec/ptrace: fix get_dumpable() incorrect tests	2013-11-29 11:11:44 -08:00
fcntl.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
fhandle.c
file_table.c	fput: task_work_add() can fail if the caller has passed exit_task_work()	2013-06-15 05:39:08 +04:00
file.c	don't bother with deferred freeing of fdtables	2013-05-01 17:31:42 -04:00
filesystems.c	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
fs_struct.c	constify path_get/path_put and fs_struct.c stuff	2013-03-01 23:51:07 -05:00
fs-writeback.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
generic_acl.c
inode.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
internal.h	splice: don't pass the address of ->f_pos to methods	2013-06-20 19:02:45 +04:00
ioctl.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
ioprio.c
Kconfig	efivarfs: Move to fs/efivarfs	2013-04-17 13:25:09 +01:00
Kconfig.binfmt	fs: make binfmt support for #! scripts modular and removable	2013-04-30 17:04:04 -07:00
libfs.c
locks.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
mbcache.c
mount.h	get rid of full-hash scan on detaching vfsmounts	2013-04-09 14:12:52 -04:00
mpage.c
namei.c	use can_lookup() instead of direct checks of ->i_op->lookup	2013-06-15 05:41:45 +04:00
namespace.c	VFS: collect_mounts() should return an ERR_PTR	2013-08-29 09:47:35 -07:00
no-block.c
open.c	make SYSCALL_DEFINE<n>-generated wrappers do asmlinkage_protect	2013-03-03 22:58:33 -05:00
pipe.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
pnode.c	vfs: Fix invalid ida_remove() call	2013-05-31 15:16:33 -04:00
pnode.h	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
posix_acl.c
proc_namespace.c
read_write.c	splice: don't pass the address of ->f_pos to methods	2013-06-20 19:02:45 +04:00
readdir.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
select.c	sched/rt: Move rt specific bits into new header file	2013-02-07 20:51:08 +01:00
seq_file.c	seq_file: always update file->f_pos in seq_lseek()	2013-11-13 12:05:34 +09:00
signalfd.c	switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE	2013-03-03 22:58:46 -05:00
splice.c	fs: fix new splice.c kernel-doc warning	2013-06-23 16:19:56 -10:00
stack.c
stat.c	switch vfs_getattr() to struct path	2013-02-26 02:46:08 -05:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-18 07:45:44 -07:00
super.c	livelock avoidance in sget()	2013-08-04 16:51:15 +08:00
sync.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
timerfd.c	compat: restore timerfd settime and gettime compat syscalls	2013-03-02 09:35:13 -05:00
utimes.c
xattr_acl.c
xattr.c