1. 25 11月, 2008 4 次提交
    • C
      NLM: client-side nlm_lookup_host() should avoid matching on srcaddr · a8d82d9b
      Chuck Lever 提交于
      Since commit c98451bd, the loop in nlm_lookup_host() unconditionally
      compares the host's h_srcaddr field to the incoming source address.
      For client-side nlm_host entries, both are always AF_UNSPEC, so this
      check is unnecessary.
      
      Since commit 781b61a6, which added support for AF_INET6 addresses to
      nlm_cmp_addr(), nlm_cmp_addr() now returns FALSE for AF_UNSPEC
      addresses, which causes nlm_lookup_host() to create a fresh nlm_host
      entry every time it is called on the client.
      
      These extra entries will eventually expire once the server is
      unmounted, so the impact of this regression, introduced with lockd
      IPv6 support in 2.6.28, should be minor.
      
      We could fix this by adding an arm in nlm_cmp_addr() for AF_UNSPEC
      addresses, but really, nlm_lookup_host() shouldn't be matching on the
      srcaddr field for client-side nlm_host lookups.
      Signed-off-by: NChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      a8d82d9b
    • J
      nfsd: use of unitialized list head on error exit in nfs4recover.c · e4625eb8
      J. Bruce Fields 提交于
      Thanks to Matthew Dodd for this bug report:
      
      A file label issue while running SELinux in MLS mode provoked the
      following bug, which is a result of use before init on a 'struct list_head'.
      
      In nfsd4_list_rec_dir() if the call to dentry_open() fails the 'goto
      out' skips INIT_LIST_HEAD() which results in the normally improbable
      case where list_entry() returns NULL.
      
      Trace follows.
      
      NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory
      SELinux:  Context unconfined_t:object_r:var_lib_nfs_t:s0 is not valid
      (left unmapped).
      type=1400 audit(1227298063.609:282): avc:  denied  { read } for
      pid=1890 comm="rpc.nfsd" name="v4recovery" dev=dm-0 ino=148726
      scontext=system_u:system_r:nfsd_t:s0-s15:c0.c1023
      tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=dir
      BUG: unable to handle kernel NULL pointer dereference at 00000004
      IP: [<c050894e>] list_del+0x6/0x60
      *pde = 0d9ce067 *pte = 00000000
      Oops: 0000 [#1] SMP
      Modules linked in: nfsd lockd nfs_acl auth_rpcgss exportfs autofs4
      sunrpc ipv6 dm_multipath scsi_dh ppdev parport_pc sg parport floppy
      ata_piix pata_acpi ata_generic libata pcnet32 i2c_piix4 mii pcspkr
      i2c_core dm_snapshot dm_zero dm_mirror dm_log dm_mod BusLogic sd_mod
      scsi_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last
      unloaded: microcode]
      
      Pid: 1890, comm: rpc.nfsd Not tainted (2.6.27.5-37.fc9.i686 #1)
      EIP: 0060:[<c050894e>] EFLAGS: 00010217 CPU: 0
      EIP is at list_del+0x6/0x60
      EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: cd99e480
      ESI: cf9caed8 EDI: 00000000 EBP: cf9caebc ESP: cf9caeb8
        DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
      Process rpc.nfsd (pid: 1890, ti=cf9ca000 task=cf4de580 task.ti=cf9ca000)
      Stack: 00000000 cf9caef0 d0a9f139 c0496d04 d0a9f217 fffffff3 00000000
      00000000
              00000000 00000000 cf32b220 00000000 00000008 00000801 cf9caefc
      d0a9f193
              00000000 cf9caf08 d0a9b6ea 00000000 cf9caf1c d0a874f2 cf9c3004
      00000008
      Call Trace:
        [<d0a9f139>] ? nfsd4_list_rec_dir+0xf3/0x13a [nfsd]
        [<c0496d04>] ? do_path_lookup+0x12d/0x175
        [<d0a9f217>] ? load_recdir+0x0/0x26 [nfsd]
        [<d0a9f193>] ? nfsd4_recdir_load+0x13/0x34 [nfsd]
        [<d0a9b6ea>] ? nfs4_state_start+0x2a/0xc5 [nfsd]
        [<d0a874f2>] ? nfsd_svc+0x51/0xff [nfsd]
        [<d0a87f2d>] ? write_svc+0x0/0x1e [nfsd]
        [<d0a87f48>] ? write_svc+0x1b/0x1e [nfsd]
        [<d0a87854>] ? nfsctl_transaction_write+0x3a/0x61 [nfsd]
        [<c04b6a4e>] ? sys_nfsservctl+0x116/0x154
        [<c04975c1>] ? putname+0x24/0x2f
        [<c04975c1>] ? putname+0x24/0x2f
        [<c048d49f>] ? do_sys_open+0xad/0xb7
        [<c048d337>] ? filp_close+0x50/0x5a
        [<c048d4eb>] ? sys_open+0x1e/0x26
        [<c0403cca>] ? syscall_call+0x7/0xb
        [<c064007b>] ? init_cyrix+0x185/0x490
        =======================
      Code: 75 e1 8b 53 08 8d 4b 04 8d 46 04 e8 75 00 00 00 8b 53 10 8d 4b 0c
      8d 46 0c e8 67 00 00 00 5b 5e 5f 5d c3 90 90 55 89 e5 53 89 c3 <8b> 40
      04 8b 00 39 d8 74 16 50 53 68 3e d6 6f c0 6a 30 68 78 d6
      EIP: [<c050894e>] list_del+0x6/0x60 SS:ESP 0068:cf9caeb8
      ---[ end trace a89c4ad091c4ad53 ]---
      
      Cc: Matthew N. Dodd <Matthew.Dodd@spart.com>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      e4625eb8
    • T
      Add a reference to sunrpc in svc_addsock · 2da2c21d
      Tom Tucker 提交于
      The svc_addsock function adds transport instances without taking a
      reference on the sunrpc.ko module, however, the generic transport
      destruction code drops a reference when a transport instance
      is destroyed.
      
      Add a try_module_get call to the svc_addsock function for transport
      instances added by this function.
      Signed-off-by: NTom Tucker <tom@opengridcomputing.com>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      Tested-by: NJeff Moyer <jmoyer@redhat.com>
      2da2c21d
    • J
      nfsd: clean up grace period on early exit · 2c5e7615
      J. Bruce Fields 提交于
      If nfsd was shut down before the grace period ended, we could end up
      with a freed object still on grace_list.  Thanks to Jeff Moyer for
      reporting the resulting list corruption warnings.
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      Tested-by: NJeff Moyer <jmoyer@redhat.com>
      2c5e7615
  2. 10 11月, 2008 1 次提交
    • D
      Fix nfsd truncation of readdir results · b726e923
      Doug Nazar 提交于
      Commit 8d7c4203 "nfsd: fix failure to set eof in readdir in some
      situations" introduced a bug: on a directory in an exported ext3
      filesystem with dir_index unset, a READDIR will only return about 250
      entries, even if the directory was larger.
      
      Bisected it back to this commit; reverting it fixes the problem.
      
      It turns out that in this case ext3 reads a block at a time, then
      returns from readdir, which means we can end up with buf.full==0 but
      with more entries in the directory still to be read.  Before 8d7c4203
      (but after c002a6c7 "Optimise NFS readdir hack slightly"), this would
      cause us to return the READDIR result immediately, but with the eof bit
      unset.  That could cause a performance regression (because the client
      would need more roundtrips to the server to read the whole directory),
      but no loss in correctness, since the cleared eof bit caused the client
      to send another readdir.  After 8d7c4203, the setting of the eof bit
      made this a correctness problem.
      
      So, move nfserr_eof into the loop and remove the buf.full check so that
      we loop until buf.used==0.  The following seems to do the right thing
      and reduces the network traffic since we don't return a READDIR result
      until the buffer is full.
      
      Tested on an empty directory & large directory; eof is properly sent and
      there are no more short buffers.
      Signed-off-by: NDoug Nazar <nazard@dragoninc.ca>
      Cc: David Woodhouse <David.Woodhouse@intel.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      b726e923
  3. 31 10月, 2008 2 次提交
    • C
      NLM: Set address family before calling nlm_host_rebooted() · d7dc61d0
      Chuck Lever 提交于
      The nlm_host_rebooted() function uses nlm_cmp_addr() to find an
      nsm_handle that matches the rebooted peer.  In order for this to work,
      the passed-in address must have a proper address family.
      
      This fixes a post-2.6.28 regression introduced by commit 781b61a6, which
      added AF_INET6 support to nlm_cmp_addr().  Before that commit,
      nlm_cmp_addr() didn't care about the address family; it compared only
      the sin_addr.s_addr field for equality.
      Signed-off-by: NChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      d7dc61d0
    • J
      nfsd: fix failure to set eof in readdir in some situations · 8d7c4203
      J. Bruce Fields 提交于
      Before 14f7dd63 "[PATCH] Copy XFS
      readdir hack into nfsd code", readdir_cd->err was reset to eof before
      each call to vfs_readdir; afterwards, it is set only once.  Similarly,
      c002a6c7 "[PATCH] Optimise NFS readdir
      hack slightly", can cause us to exit without nfserr_eof set.  Fix this.
      
      This ensures the "eof" bit is set when needed in readdir replies.  (The
      particular case I saw was an nfsv4 readdir of an empty directory, which
      returned with no entries (the protocol requires "." and ".." to be
      filtered out), but with eof unset.)
      
      Cc: David Woodhouse <David.Woodhouse@intel.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>
      8d7c4203
  4. 27 10月, 2008 17 次提交
  5. 26 10月, 2008 4 次提交
  6. 24 10月, 2008 12 次提交