Yanjun Zhang
632344b9ef
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
[ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ]
On the node of an NFS client, some files saved in the mountpoint of the
NFS server were copied to another location of the same NFS server.
Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference
crash with the following syslog:
[232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116
[232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116
[232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058
[232066.588586] Mem abort info:
[232066.588701] ESR = 0x0000000096000007
[232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits
[232066.589084] SET = 0, FnV = 0
[232066.589216] EA = 0, S1PTW = 0
[232066.589340] FSC = 0x07: level 3 translation fault
[232066.589559] Data abort info:
[232066.589683] ISV = 0, ISS = 0x00000007
[232066.589842] CM = 0, WnR = 0
[232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400
[232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000
[232066.590757] Internal error: Oops: 96000007 [#1] SMP
[232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2
[232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs
[232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1
[232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06
[232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4]
[232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4]
[232066.598595] sp : ffff8000f568fc70
[232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000
[232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001
[232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050
[232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000
[232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000
[232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6
[232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828
[232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a
[232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058
[232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000
[232066.601636] Call trace:
[232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4]
[232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4]
[232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4]
[232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4]
[232066.602690] kthread+0x110/0x114
[232066.602830] ret_from_fork+0x10/0x20
[232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00)
[232066.603284] SMP: stopping secondary CPUs
[232066.606936] Starting crashdump kernel...
[232066.607146] Bye!
Analysing the vmcore, we know that nfs4_copy_state listed by destination
nfs_server->ss_copies was added by the field copies in handle_async_copy(),
and we found a waiting copy process with the stack as:
PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp"
#0 [ffff8001116ef740] __switch_to at ffff8000081b92f4
#1 [ffff8001116ef760] __schedule at ffff800008dd0650
#2 [ffff8001116ef7c0] schedule at ffff800008dd0a00
#3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0
#4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c
#5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898
#6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4]
#7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4]
#8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4]
#9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4]
The NULL-pointer dereference was due to nfs42_complete_copies() listed
the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state.
So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and
the data accessed through this pointer was also incorrect. Generally,
the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or
open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state().
When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED
and copies are not deleted in nfs_server->ss_copies, the source state
may be passed to the nfs42_complete_copies() process earlier, resulting
in this crash scene finally. To solve this issue, we add a list_head
nfs_server->ss_src_copies for a server-to-server copy specially.
Fixes: 0e65a32c8a ("NFS: handle source server reboot")
Signed-off-by: Yanjun Zhang <zhangyanjun@cestc.cn>
Reviewed-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-10-17 15:22:19 +02:00
..
2023-07-19 16:21:11 +02:00
2024-03-15 10:48:13 -04:00
2024-03-06 14:45:14 +00:00
2024-08-29 17:30:43 +02:00
2024-06-12 11:03:39 +02:00
2023-06-28 11:12:35 +02:00
2024-02-23 09:12:40 +01:00
2023-03-30 12:49:23 +02:00
2023-05-11 23:03:40 +09:00
2023-03-11 13:55:28 +01:00
2023-11-20 11:52:08 +01:00
2024-09-18 19:23:05 +02:00
2024-06-16 13:41:35 +02:00
2024-02-23 09:12:49 +01:00
2024-04-03 15:19:33 +02:00
2024-05-17 11:55:54 +02:00
2023-05-30 14:03:21 +01:00
2024-06-21 14:35:51 +02:00
2024-09-12 11:10:21 +02:00
2024-08-29 17:30:17 +02:00
2023-06-21 16:00:51 +02:00
2024-05-17 11:56:10 +02:00
2024-08-29 17:30:52 +02:00
2024-10-17 15:21:19 +02:00
2023-09-23 11:11:00 +02:00
2023-03-30 12:49:05 +02:00
2024-06-12 11:03:08 +02:00
2023-05-30 14:03:22 +01:00
2023-09-13 09:43:03 +02:00
2023-05-24 17:32:36 +01:00
2024-01-31 16:17:00 -08:00
2024-01-25 15:27:42 -08:00
2024-08-29 17:30:15 +02:00
2024-06-12 11:03:08 +02:00
2023-07-23 13:49:21 +02:00
2023-05-11 23:03:00 +09:00
2024-08-14 13:53:01 +02:00
2023-07-19 16:20:55 +02:00
2024-10-17 15:21:48 +02:00
2023-07-19 16:22:15 +02:00
2024-04-27 17:07:17 +02:00
2023-07-19 16:21:17 +02:00
2024-07-18 13:18:34 +02:00
2024-08-29 17:30:17 +02:00
2024-07-18 13:18:34 +02:00
2023-10-06 14:57:04 +02:00
2024-03-06 14:45:19 +00:00
2024-08-19 06:00:07 +02:00
2024-02-23 09:12:51 +01:00
2024-01-25 15:27:37 -08:00
2023-08-30 16:11:12 +02:00
2024-08-14 13:52:57 +02:00
2024-07-05 09:31:59 +02:00
2024-07-18 13:18:31 +02:00
2024-05-17 11:56:20 +02:00
2024-02-23 09:12:51 +01:00
2024-02-23 09:12:28 +01:00
2023-03-30 12:49:13 +02:00
2023-03-30 12:49:13 +02:00
2024-06-12 11:03:34 +02:00
2024-03-15 10:48:21 -04:00
2024-04-03 15:19:28 +02:00
2023-12-13 18:39:03 +01:00
2024-08-29 17:30:14 +02:00
2023-08-30 16:11:10 +02:00
2023-12-20 17:00:20 +01:00
2023-05-17 11:53:40 +02:00
2024-01-01 12:39:08 +00:00
2024-10-17 15:21:32 +02:00
2024-06-12 11:03:21 +02:00
2023-04-13 16:55:17 +02:00
2024-04-10 16:28:32 +02:00
2023-05-24 17:32:31 +01:00
2024-01-01 12:39:05 +00:00
2023-04-13 16:55:17 +02:00
2024-03-26 18:21:02 -04:00
2023-04-13 16:55:17 +02:00
2023-04-13 16:55:17 +02:00
2023-09-23 11:11:08 +02:00
2024-05-17 11:56:16 +02:00
2024-02-16 19:06:24 +01:00
2024-07-05 09:32:00 +02:00
2024-05-02 16:29:29 +02:00
2023-11-28 17:07:18 +00:00
2024-01-05 15:18:38 +01:00
2024-03-26 18:20:23 -04:00
2024-10-17 15:21:10 +02:00
2023-03-22 13:34:04 +01:00
2024-10-17 15:22:03 +02:00
2024-02-23 09:12:51 +01:00
2024-07-05 09:31:47 +02:00
2023-10-25 12:03:12 +02:00
2024-10-17 15:21:17 +02:00
2024-07-25 09:49:20 +02:00
2024-09-08 07:53:10 +02:00
2024-07-11 12:47:14 +02:00
2023-04-13 16:55:32 +02:00
2023-03-10 09:33:37 +01:00
2023-11-28 17:06:54 +00:00
2024-05-17 11:56:07 +02:00
2024-04-03 15:19:42 +02:00
2024-01-10 17:10:33 +01:00
2023-12-03 07:32:07 +01:00
2023-07-01 13:16:22 +02:00
2024-01-25 15:27:22 -08:00
2024-02-16 19:06:30 +01:00
2024-05-17 11:55:52 +02:00
2024-08-03 08:49:29 +02:00
2023-11-20 11:52:04 +01:00
2024-09-08 07:53:09 +02:00
2024-05-17 11:56:08 +02:00
2024-10-17 15:22:04 +02:00
2023-11-20 11:52:16 +01:00
2024-07-05 09:31:48 +02:00
2023-09-13 09:43:03 +02:00
2023-10-06 14:56:41 +02:00
2024-08-29 17:30:43 +02:00
2023-03-10 09:34:15 +01:00
2024-02-23 09:12:38 +01:00
2023-09-23 11:11:09 +02:00
2023-03-22 13:33:57 +01:00
2023-10-06 14:57:03 +02:00
2024-03-26 18:20:22 -04:00
2024-03-26 18:20:22 -04:00
2024-05-25 16:21:31 +02:00
2023-12-13 18:39:17 +01:00
2023-08-23 17:52:20 +02:00
2023-09-13 09:42:46 +02:00
2023-07-19 16:22:00 +02:00
2023-10-10 22:00:37 +02:00
2024-02-05 20:12:49 +00:00
2023-12-08 08:51:20 +01:00
2024-04-17 11:18:28 +02:00
2024-08-29 17:30:17 +02:00
2024-08-03 08:49:05 +02:00
2023-10-25 12:03:16 +02:00
2024-01-01 12:38:52 +00:00
2024-06-27 13:46:22 +02:00
2023-09-13 09:42:53 +02:00
2024-01-01 12:38:58 +00:00
2023-04-26 14:28:41 +02:00
2023-03-10 09:33:29 +01:00
2023-12-13 18:39:17 +01:00
2024-08-11 12:35:53 +02:00
2024-04-03 15:19:51 +02:00
2023-03-10 09:34:20 +01:00
2024-07-11 12:47:16 +02:00
2024-01-31 16:17:01 -08:00
2023-10-19 23:08:56 +02:00
2024-03-01 13:26:36 +01:00
2023-10-06 14:57:03 +02:00
2023-03-17 08:50:19 +01:00
2023-09-19 12:28:02 +02:00
2024-07-25 09:49:07 +02:00
2023-12-20 17:00:26 +01:00
2024-05-17 11:55:51 +02:00
2024-09-12 11:10:17 +02:00
2024-07-18 13:18:31 +02:00
2024-06-27 13:46:23 +02:00
2024-01-05 15:18:40 +01:00
2024-03-26 18:20:52 -04:00
2023-05-30 14:03:22 +01:00
2024-07-11 12:47:04 +02:00
2024-01-05 15:18:29 +01:00
2024-01-10 17:10:27 +01:00
2023-11-20 11:51:55 +01:00
2024-01-25 15:27:51 -08:00
2024-03-06 14:45:08 +00:00
2024-03-06 14:45:17 +00:00
2024-10-17 15:22:19 +02:00
2024-04-03 15:19:34 +02:00
2023-10-15 18:32:41 +02:00
2023-03-10 09:33:24 +01:00
2023-09-13 09:42:48 +02:00
2023-09-13 09:42:22 +02:00
2023-07-19 16:21:08 +02:00
2024-06-12 11:03:17 +02:00
2023-03-30 12:49:09 +02:00
2024-07-05 09:31:50 +02:00
2024-08-03 08:49:05 +02:00
2023-03-30 12:49:05 +02:00
2024-09-04 13:24:59 +02:00
2023-06-14 11:15:29 +02:00
2024-01-10 17:10:32 +01:00
2024-10-17 15:22:14 +02:00
2023-04-13 16:55:24 +02:00
2024-08-03 08:49:46 +02:00
2024-02-23 09:12:51 +01:00
2024-08-03 08:49:41 +02:00
2023-04-13 16:55:20 +02:00
2024-08-29 17:30:18 +02:00
2024-01-31 16:17:09 -08:00
2023-05-24 17:32:43 +01:00
2023-03-10 09:33:46 +01:00
2024-03-26 18:20:28 -04:00
2023-05-11 23:03:00 +09:00
2023-11-08 14:11:02 +01:00
2024-02-23 09:12:51 +01:00
2024-06-12 11:03:21 +02:00
2024-08-14 13:52:50 +02:00
2024-01-05 15:18:40 +01:00
2023-07-27 08:50:38 +02:00
2023-07-27 08:50:38 +02:00
2023-11-28 17:07:03 +00:00
2023-10-19 23:08:50 +02:00
2023-10-19 23:08:50 +02:00
2023-08-30 16:11:12 +02:00
2023-07-19 16:22:11 +02:00
2024-04-13 13:05:25 +02:00
2024-04-13 13:05:07 +02:00
2023-10-06 14:57:03 +02:00
2023-12-13 18:39:17 +01:00
2024-04-03 15:19:35 +02:00
2024-01-31 16:17:02 -08:00
2024-02-23 09:12:51 +01:00
2024-10-17 15:21:10 +02:00
2023-08-30 16:11:11 +02:00
2024-04-10 16:28:34 +02:00
2024-07-11 12:47:16 +02:00
2023-10-06 14:56:41 +02:00
2023-07-23 13:49:43 +02:00
2024-06-21 14:36:00 +02:00
2023-07-19 16:21:54 +02:00
2024-06-12 11:03:32 +02:00
2024-05-17 11:55:56 +02:00
2024-08-29 17:30:28 +02:00
2024-06-16 13:41:42 +02:00
2024-03-01 13:26:36 +01:00
2024-02-23 09:12:51 +01:00
2024-01-10 17:10:27 +01:00
2024-02-23 09:12:51 +01:00
2023-12-13 18:39:08 +01:00
2023-11-28 17:06:57 +00:00
2024-03-01 13:26:32 +01:00
2024-05-17 11:56:24 +02:00
2024-04-27 17:07:10 +02:00
2024-07-05 09:31:59 +02:00
2024-08-11 12:35:51 +02:00
2023-03-30 12:49:22 +02:00
2024-08-03 08:49:34 +02:00
2023-09-19 12:27:59 +02:00
2023-07-27 08:50:49 +02:00
2023-05-11 23:03:01 +09:00
2024-05-17 11:56:13 +02:00
2023-08-16 18:27:20 +02:00
2024-08-14 13:52:54 +02:00
2023-04-20 12:35:12 +02:00
2023-03-22 13:33:59 +01:00
2023-03-10 09:33:34 +01:00
2024-06-27 13:46:17 +02:00
2024-04-17 11:18:23 +02:00
2023-03-10 09:33:52 +01:00
2024-08-29 17:30:56 +02:00
2024-10-17 15:21:46 +02:00
2023-05-30 14:03:20 +01:00
2024-10-17 15:21:12 +02:00
2023-11-20 11:52:04 +01:00
2024-04-03 15:19:46 +02:00
2024-09-18 19:23:04 +02:00
2023-11-20 11:52:17 +01:00
2023-05-11 23:03:28 +09:00
2023-03-10 09:34:34 +01:00
2023-07-19 16:22:10 +02:00
2023-11-28 17:06:55 +00:00
2024-10-17 15:21:26 +02:00