1. 14 7月, 2017 2 次提交
  2. 29 4月, 2017 1 次提交
    • A
      nfs/filelayout: fix NULL pointer dereference in fl_pnfs_update_layout() · 209aa230
      Artem Savkov 提交于
      Calling pnfs_put_lset on an IS_ERR pointer results in a NULL pointer
      dereference like the one below. At the same time the check of retvalue
      of filelayout_check_deviceid() sets lseg to error, but does not free it
      before that.
      
      [ 3000.636161] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c
      [ 3000.636970] IP: pnfs_put_lseg+0x29/0x100 [nfsv4]
      [ 3000.637420] PGD 4f23b067
      [ 3000.637421] PUD 4a0f4067
      [ 3000.637679] PMD 0
      [ 3000.637937]
      [ 3000.638287] Oops: 0000 [#1] SMP
      [ 3000.638591] Modules linked in: nfs_layout_nfsv41_files nfsv3 nfnetlink_queue nfnetlink_log nfnetlink bluetooth rfkill rpcsec_gss_krb5 nfsv4 nfs fscache binfmt_misc arc4 md4 nls_utf8 cifs ccm dns_resolver rpcrdma ib_isert iscsi_target_mod ib_iser rdma_cm iw_cm libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_ucm ib_uverbs ib_umad ib_cm ib_core nls_koi8_u nls_cp932 ts_kmp nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr virtio_balloon ppdev virtio_rng parport_pc i2c_piix4 parport acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c ata_generic pata_acpi virtio_blk virtio_net cirrus drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops crc32c_intel ata_piix ttm libata drm serio_raw
      [ 3000.645245]  i2c_core virtio_pci virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: xt_u32]
      [ 3000.646360] CPU: 1 PID: 26402 Comm: date Not tainted 4.11.0-rc7.1.el7.test.x86_64 #1
      [ 3000.647092] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
      [ 3000.647638] task: ffff8800415ada00 task.stack: ffffc90000ff0000
      [ 3000.648207] RIP: 0010:pnfs_put_lseg+0x29/0x100 [nfsv4]
      [ 3000.648696] RSP: 0018:ffffc90000ff39b8 EFLAGS: 00010246
      [ 3000.649193] RAX: 0000000000000000 RBX: fffffffffffffff4 RCX: 00000000000d43be
      [ 3000.649859] RDX: 00000000000d43bd RSI: 0000000000000000 RDI: fffffffffffffff4
      [ 3000.650530] RBP: ffffc90000ff39d8 R08: 000000000001e320 R09: ffffffffa05c35ce
      [ 3000.651203] R10: ffff88007fd1e320 R11: ffffea0001283d80 R12: 0000000001400040
      [ 3000.651875] R13: ffff88004f77d9f0 R14: ffffc90000ff3cd8 R15: ffff8800417ade00
      [ 3000.652546] FS:  00007fac4d5cd740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
      [ 3000.653304] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 3000.653849] CR2: 000000000000003c CR3: 000000004f080000 CR4: 00000000000406e0
      [ 3000.654527] Call Trace:
      [ 3000.654771]  fl_pnfs_update_layout.constprop.20+0x10c/0x150 [nfs_layout_nfsv41_files]
      [ 3000.655505]  filelayout_pg_init_write+0x21d/0x270 [nfs_layout_nfsv41_files]
      [ 3000.656195]  __nfs_pageio_add_request+0x11c/0x490 [nfs]
      [ 3000.656698]  nfs_pageio_add_request+0xac/0x260 [nfs]
      [ 3000.657180]  nfs_do_writepage+0x109/0x2e0 [nfs]
      [ 3000.657616]  nfs_writepages_callback+0x16/0x30 [nfs]
      [ 3000.658096]  write_cache_pages+0x26f/0x510
      [ 3000.658495]  ? nfs_do_writepage+0x2e0/0x2e0 [nfs]
      [ 3000.658946]  ? _raw_spin_unlock_bh+0x1e/0x20
      [ 3000.659357]  ? wb_wakeup_delayed+0x5f/0x70
      [ 3000.659748]  ? __mark_inode_dirty+0x2eb/0x360
      [ 3000.660170]  nfs_writepages+0x84/0xd0 [nfs]
      [ 3000.660575]  ? nfs_updatepage+0x571/0xb70 [nfs]
      [ 3000.661012]  do_writepages+0x1e/0x30
      [ 3000.661358]  __filemap_fdatawrite_range+0xc6/0x100
      [ 3000.661819]  filemap_write_and_wait_range+0x41/0x90
      [ 3000.662292]  nfs_file_fsync+0x34/0x1f0 [nfs]
      [ 3000.662704]  vfs_fsync_range+0x3d/0xb0
      [ 3000.663065]  vfs_fsync+0x1c/0x20
      [ 3000.663385]  nfs4_file_flush+0x57/0x80 [nfsv4]
      [ 3000.663813]  filp_close+0x2f/0x70
      [ 3000.664132]  __close_fd+0x9a/0xc0
      [ 3000.664453]  SyS_close+0x23/0x50
      [ 3000.664785]  do_syscall_64+0x67/0x180
      [ 3000.665162]  entry_SYSCALL64_slow_path+0x25/0x25
      [ 3000.665600] RIP: 0033:0x7fac4d0e1e90
      [ 3000.665946] RSP: 002b:00007ffd54e90c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
      [ 3000.666679] RAX: ffffffffffffffda RBX: 00007fac4d3b5400 RCX: 00007fac4d0e1e90
      [ 3000.667349] RDX: 0000000000000000 RSI: 00007fac4d5d9000 RDI: 0000000000000001
      [ 3000.668031] RBP: 0000000000000000 R08: 00007fac4d3b6a00 R09: 00007fac4d5cd740
      [ 3000.668709] R10: 00007ffd54e909e0 R11: 0000000000000246 R12: 0000000000000000
      [ 3000.669385] R13: 00007fac4d3b5e80 R14: 0000000000000000 R15: 0000000000000000
      [ 3000.670061] Code: 00 00 66 66 66 66 90 55 48 85 ff 48 89 e5 41 56 41 55 41 54 53 48 89 fb 0f 84 97 00 00 00 f6 05 16 8f bc ff 10 0f 85 a6 00 00 00 <4c> 8b 63 48 48 8d 7b 38 49 8b 84 24 90 00 00 00 4c 8d a8 88 00
      [ 3000.671831] RIP: pnfs_put_lseg+0x29/0x100 [nfsv4] RSP: ffffc90000ff39b8
      [ 3000.672462] CR2: 000000000000003c
      Signed-off-by: NArtem Savkov <asavkov@redhat.com>
      Signed-off-by: NTrond Myklebust <trond.myklebust@primarydata.com>
      209aa230
  3. 25 4月, 2017 1 次提交
  4. 31 3月, 2017 1 次提交
  5. 28 3月, 2017 3 次提交
  6. 18 3月, 2017 2 次提交
  7. 28 2月, 2017 1 次提交
  8. 31 1月, 2017 1 次提交
  9. 20 12月, 2016 1 次提交
  10. 02 12月, 2016 1 次提交
  11. 21 7月, 2016 1 次提交
  12. 06 7月, 2016 2 次提交
  13. 26 5月, 2016 1 次提交
  14. 09 5月, 2016 1 次提交
  15. 22 1月, 2016 1 次提交
  16. 29 12月, 2015 2 次提交
  17. 18 9月, 2015 1 次提交
    • K
      nfs/filelayout: Fix NULL reference caused by double freeing of fh_array · 3ec0c979
      Kinglong Mee 提交于
      If filelayout_decode_layout fail, _filelayout_free_lseg will causes
      a double freeing of fh_array.
      
      [ 1179.279800] BUG: unable to handle kernel NULL pointer dereference at           (null)
      [ 1179.280198] IP: [<ffffffffa027222d>] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
      [ 1179.281010] PGD 0
      [ 1179.281443] Oops: 0000 [#1]
      [ 1179.281831] Modules linked in: nfs_layout_nfsv41_files(OE) nfsv4(OE) nfs(OE) fscache(E) xfs libcrc32c coretemp nfsd crct10dif_pclmul ppdev crc32_pclmul crc32c_intel auth_rpcgss ghash_clmulni_intel nfs_acl lockd vmw_balloon grace sunrpc parport_pc vmw_vmci parport shpchp i2c_piix4 vmwgfx drm_kms_helper ttm drm serio_raw mptspi scsi_transport_spi mptscsih e1000 mptbase ata_generic pata_acpi [last unloaded: fscache]
      [ 1179.283891] CPU: 0 PID: 13336 Comm: cat Tainted: G           OE   4.3.0-rc1-pnfs+ #244
      [ 1179.284323] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
      [ 1179.285206] task: ffff8800501d48c0 ti: ffff88003e3c4000 task.ti: ffff88003e3c4000
      [ 1179.285668] RIP: 0010:[<ffffffffa027222d>]  [<ffffffffa027222d>] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
      [ 1179.286612] RSP: 0018:ffff88003e3c77f8  EFLAGS: 00010202
      [ 1179.287092] RAX: 0000000000000000 RBX: ffff88001fe78900 RCX: 0000000000000000
      [ 1179.287731] RDX: ffffea0000f40760 RSI: ffff88001fe789c8 RDI: ffff88001fe789c0
      [ 1179.288383] RBP: ffff88003e3c7810 R08: ffffea0000f40760 R09: 0000000000000000
      [ 1179.289170] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88001fe789c8
      [ 1179.289959] R13: ffff88001fe789c0 R14: ffff88004ec05a80 R15: ffff88004f935b88
      [ 1179.290791] FS:  00007f4e66bb5700(0000) GS:ffffffff81c29000(0000) knlGS:0000000000000000
      [ 1179.291580] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 1179.292209] CR2: 0000000000000000 CR3: 00000000203f8000 CR4: 00000000001406f0
      [ 1179.292731] Stack:
      [ 1179.293195]  ffff88001fe78900 00000000000000d0 ffff88001fe78178 ffff88003e3c7868
      [ 1179.293676]  ffffffffa0272737 0000000000000001 0000000000000001 ffff88001fe78800
      [ 1179.294151]  00000000614fffce ffffffff81727671 ffff88001fe78100 ffff88001fe78100
      [ 1179.294623] Call Trace:
      [ 1179.295092]  [<ffffffffa0272737>] filelayout_alloc_lseg+0xa7/0x2d0 [nfs_layout_nfsv41_files]
      [ 1179.295625]  [<ffffffff81727671>] ? out_of_line_wait_on_bit+0x81/0xb0
      [ 1179.296133]  [<ffffffffa040407e>] pnfs_layout_process+0xae/0x320 [nfsv4]
      [ 1179.296632]  [<ffffffffa03e0a01>] nfs4_proc_layoutget+0x2b1/0x360 [nfsv4]
      [ 1179.297134]  [<ffffffffa0402983>] pnfs_update_layout+0x853/0xb30 [nfsv4]
      [ 1179.297632]  [<ffffffffa039db24>] ? nfs_get_lock_context+0x74/0x170 [nfs]
      [ 1179.298158]  [<ffffffffa0271807>] filelayout_pg_init_read+0x37/0x50 [nfs_layout_nfsv41_files]
      [ 1179.298834]  [<ffffffffa03a72d9>] __nfs_pageio_add_request+0x119/0x460 [nfs]
      [ 1179.299385]  [<ffffffffa03a6bd7>] ? nfs_create_request.part.9+0x37/0x2e0 [nfs]
      [ 1179.299872]  [<ffffffffa03a7cc3>] nfs_pageio_add_request+0xa3/0x1b0 [nfs]
      [ 1179.300362]  [<ffffffffa03a8635>] readpage_async_filler+0x85/0x260 [nfs]
      [ 1179.300907]  [<ffffffff81180cb1>] read_cache_pages+0x91/0xd0
      [ 1179.301391]  [<ffffffffa03a85b0>] ? nfs_read_completion+0x220/0x220 [nfs]
      [ 1179.301867]  [<ffffffffa03a8dc8>] nfs_readpages+0x128/0x200 [nfs]
      [ 1179.302330]  [<ffffffff81180ef3>] __do_page_cache_readahead+0x203/0x280
      [ 1179.302784]  [<ffffffff81180dc8>] ? __do_page_cache_readahead+0xd8/0x280
      [ 1179.303413]  [<ffffffff81181116>] ondemand_readahead+0x1a6/0x2f0
      [ 1179.303855]  [<ffffffff81181371>] page_cache_sync_readahead+0x31/0x50
      [ 1179.304286]  [<ffffffff811750a6>] generic_file_read_iter+0x4a6/0x5c0
      [ 1179.304711]  [<ffffffffa03a0316>] ? __nfs_revalidate_mapping+0x1f6/0x240 [nfs]
      [ 1179.305132]  [<ffffffffa039ccf2>] nfs_file_read+0x52/0xa0 [nfs]
      [ 1179.305540]  [<ffffffff811e343c>] __vfs_read+0xcc/0x100
      [ 1179.305936]  [<ffffffff811e3d15>] vfs_read+0x85/0x130
      [ 1179.306326]  [<ffffffff811e4a98>] SyS_read+0x58/0xd0
      [ 1179.306708]  [<ffffffff8172caaf>] entry_SYSCALL_64_fastpath+0x12/0x76
      [ 1179.307094] Code: c4 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 8b 07 49 89 f4 85 c0 74 47 48 8b 06 49 89 fd <48> 8b 38 48 85 ff 74 22 31 db eb 0c 48 63 d3 48 8b 3c d0 48 85
      [ 1179.308357] RIP  [<ffffffffa027222d>] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
      [ 1179.309177]  RSP <ffff88003e3c77f8>
      [ 1179.309582] CR2: 0000000000000000
      Signed-off-by: NKinglong Mee <kinglongmee@gmail.com>
      Signed-off-by: NTrond Myklebust <trond.myklebust@primarydata.com>
      3ec0c979
  18. 02 6月, 2015 1 次提交
    • T
      writeback: separate out include/linux/backing-dev-defs.h · 66114cad
      Tejun Heo 提交于
      With the planned cgroup writeback support, backing-dev related
      declarations will be more widely used across block and cgroup;
      unfortunately, including backing-dev.h from include/linux/blkdev.h
      makes cyclic include dependency quite likely.
      
      This patch separates out backing-dev-defs.h which only has the
      essential definitions and updates blkdev.h to include it.  c files
      which need access to more backing-dev details now include
      backing-dev.h directly.  This takes backing-dev.h off the common
      include dependency chain making it a lot easier to use it across block
      and cgroup.
      
      v2: fs/fat build failure fixed.
      Signed-off-by: NTejun Heo <tj@kernel.org>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Cc: Jens Axboe <axboe@kernel.dk>
      Signed-off-by: NJens Axboe <axboe@fb.com>
      66114cad
  19. 28 3月, 2015 4 次提交
  20. 18 2月, 2015 1 次提交
  21. 14 2月, 2015 1 次提交
  22. 04 2月, 2015 10 次提交