Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-06 13:16:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
74dbd0b53e
linux-stable/fs
History
Sasha Levin e9a7f3230d nfsd: Fix oops when parsing a 0 length export 
commit b2ea70afad upstream.

expkey_parse() oopses when handling a 0 length export. This is easily
triggerable from usermode by writing 0 bytes into
'/proc/[proc id]/net/rpc/nfsd.fh/channel'.

Below is the log:

[ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff
[ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
[ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160
[ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 1402.287632] CPU 1
[ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6
[ 1402.287632] RIP: 0010:[<ffffffff812b4b99>]  [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
[ 1402.287632] RSP: 0018:ffff880077f0fd68  EFLAGS: 00010292
[ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400
[ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0
[ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000
[ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000
[ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0
[ 1402.287632] FS:  00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
[ 1402.287632] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0
[ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0)
[ 1402.287632] Stack:
[ 1402.287632]  ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e
[ 1402.287632]  ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0
[ 1402.287632]  0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63
[ 1402.287632] Call Trace:
[ 1402.287632]  [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc
[ 1402.287632]  [<ffffffff81111f63>] ? might_fault+0x97/0x9e
[ 1402.287632]  [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e
[ 1402.287632]  [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f
[ 1402.287632]  [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130
[ 1402.287632]  [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a
[ 1402.287632]  [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b
[ 1402.287632]  [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad
[ 1402.287632]  [<ffffffff8113fe81>] vfs_write+0xaa/0xfd
[ 1402.287632]  [<ffffffff8114142d>] ? fget_light+0x35/0x9e
[ 1402.287632]  [<ffffffff8113ff8b>] sys_write+0x48/0x6f
[ 1402.287632]  [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b
[ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff
[ 1402.287632]  38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85
[ 1402.287632] RIP  [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
[ 1402.287632]  RSP <ffff880077f0fd68>
[ 1402.287632] CR2: ffff880077c49fff
[ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]---

Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Neil Brown <neilb@suse.de>
Cc: linux-nfs@vger.kernel.org
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
2012-02-11 15:38:30 +01:00
..
9p 9p: use an IS_ERR test rather than a NULL test 2008-09-24 16:22:22 -05:00
adfs [PATCH] fix ->llseek() for a bunch of directories 2008-08-25 01:18:09 -04:00
affs fs: symlink write_begin allocation context fix 2009-01-18 10:35:43 -08:00
afs mm: rename page trylock 2008-08-04 21:31:34 -07:00
autofs mount options: fix autofs 2008-02-08 09:22:40 -08:00
autofs4 [PATCH] fix ->llseek() for a bunch of directories 2008-08-25 01:18:09 -04:00
befs [PATCH] fix ->llseek() for a bunch of directories 2008-08-25 01:18:09 -04:00
bfs bfs: fix Lockdep warning 2008-09-13 14:41:51 -07:00
cifs cifs: fix possible memory corruption in CIFSFindNext 2012-02-11 15:37:41 +01:00
coda [PATCH] sanitize __user_walk_fd() et.al. 2008-07-26 20:53:34 -04:00
configfs [PATCH] configfs: Consolidate locking around configfs_detach_prep() in configfs_rmdir() 2008-08-22 11:09:02 -07:00
cramfs cramfs: fix named-pipe handling 2008-08-20 15:40:32 -07:00
debugfs debugfs: fix create mutex racy fops and private data 2009-12-18 13:30:41 -08:00
devpts [PATCH] devpts: switch to IDA 2008-08-01 11:25:29 -04:00
dlm dlm: initialize file_lock struct in GETLK before copying conflicting lock 2009-02-06 14:00:45 -08:00
ecryptfs eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix 2011-04-30 16:53:25 +02:00
efs [PATCH] fix efs_lookup() 2008-08-25 01:18:04 -04:00
exportfs fs: replace remaining __FUNCTION__ occurrences 2008-04-30 08:29:54 -07:00
ext2 ext2: Fix link count corruption under heavy link+rename load 2011-04-30 16:53:10 +02:00
ext3 ext3: Fix oops in ext3_try_to_allocate_with_rsv() 2012-02-11 15:37:36 +01:00
ext4 ext4: avoid hangs in ext4_da_should_update_i_disksize() 2012-02-11 15:38:16 +01:00
fat vfat: fix 'sync' mount deadlock due to BKL->lock_super conversion 2008-08-20 08:31:19 -07:00
freevxfs fs/freevxfs/: proper externs 2008-04-29 08:06:00 -07:00
fuse fuse: prevent fuse_put_request on invalid pointer 2009-12-08 11:17:21 -08:00
gfs2 GFS2: Fix bmap allocation corner-case bug 2011-04-30 16:53:05 +02:00
hfs hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops 2012-02-11 15:38:07 +01:00
hfsplus hfsplus: refuse to mount volumes larger than 2TB 2009-11-09 16:52:04 -08:00
hostfs fs: symlink write_begin allocation context fix 2009-01-18 10:35:43 -08:00
hpfs [patch 05/14] hpfs: dont call permission() 2008-07-26 20:53:13 -04:00
hppfs [patch] hppfs: remove hppfs_permission 2008-07-26 20:53:07 -04:00
hugetlbfs hugetlbfs: return negative error code for bad mount option 2009-05-02 10:24:36 -07:00
isofs SL*B: drop kmem cache argument from constructor 2008-07-26 12:00:07 -07:00
jbd jbd/jbd2: validate sb->s_first in journal_get_superblock() 2012-02-11 15:38:03 +01:00
jbd2 jbd/jbd2: validate sb->s_first in journal_get_superblock() 2012-02-11 15:38:03 +01:00
jffs2 jffs2: Fix long-standing bug with symlink garbage collection. 2009-12-18 13:31:03 -08:00
jfs jfs: don't allow os2 xattr namespace overlap with others 2010-08-13 13:50:38 -07:00
lockd NLM: Don't hang forever on NLM unlock requests 2012-02-11 15:37:49 +01:00
minix minix: fix add link's wrong position calculation 2009-01-18 10:35:27 -08:00
msdos fatfs: add UTC timestamp option 2008-07-25 10:53:34 -07:00
ncpfs [PATCH] don't pass nameidata to __ncp_lookup_validate() 2008-07-26 20:53:37 -04:00
nfs NFS: fix the return value of nfs_file_fsync() 2011-04-30 16:53:04 +02:00
nfs_common
nfsd nfsd: Fix oops when parsing a 0 length export 2012-02-11 15:38:30 +01:00
nls sparse pointer use of zero as null 2007-10-18 14:37:31 -07:00
ntfs NTFS: update homepage 2008-09-02 19:21:37 -07:00
ocfs2 Treat writes as new when holes span across page boundaries 2011-04-30 16:53:29 +02:00
omfs omfs: fix oops when file metadata is corrupted 2008-08-15 08:35:44 -07:00
openpromfs SL*B: drop kmem cache argument from constructor 2008-07-26 12:00:07 -07:00
partitions Fix for buffer overflow in ldm_frag_add not sufficient 2012-02-11 15:37:28 +01:00
proc proc: do proper range check on readdir offset 2011-04-30 16:53:38 +02:00
qnx4 SL*B: drop kmem cache argument from constructor 2008-07-26 12:00:07 -07:00
ramfs nommu: ramfs: pages allocated to an inode's pagecache may get wrongly discarded 2011-04-30 16:53:37 +02:00
reiserfs reiserfs: truncate blocks not used by a write 2010-01-28 15:20:19 -08:00
romfs romfs_readpage: don't report errors for pages beyond i_size 2008-07-30 14:30:34 -07:00
smbfs fs: symlink write_begin allocation context fix 2009-01-18 10:35:43 -08:00
sysfs sysfs: fix hardlink count on device_move 2009-08-16 14:26:41 -07:00
sysv SL*B: drop kmem cache argument from constructor 2008-07-26 12:00:07 -07:00
ubifs UBIFS: fix master node recovery 2012-02-11 15:37:09 +01:00
udf udf: Use device size when drive reported bogus number of written blocks 2009-09-24 08:47:31 -07:00
ufs Revert "UFS: add const to parser token table" 2008-08-04 16:50:38 -07:00
vfat fatfs: add UTC timestamp option 2008-07-25 10:53:34 -07:00
xfs xfs: zero proper structure size for geometry calls 2011-04-30 16:53:36 +02:00
aio.c aio: wake all waiters when destroying ctx 2011-04-30 16:53:20 +02:00
anon_inodes.c flag parameters: NONBLOCK in anon_inode_getfd 2008-07-24 10:47:28 -07:00
attr.c [patch 4/4] vfs: immutable inode checking cleanup 2008-07-26 20:53:28 -04:00
bad_inode.c [PATCH] sanitize ->permission() prototype 2008-07-26 20:53:14 -04:00
binfmt_aout.c tracehook: exec 2008-07-26 12:00:08 -07:00
binfmt_elf_fdpic.c binfmt_elf_fdpic: Magical stack pointer index, for NEW_AUX_ENT compat. 2008-07-28 18:10:28 +09:00
binfmt_elf.c binfmt_elf: fix PT_INTERP bss handling 2009-09-24 08:47:25 -07:00
binfmt_em86.c Allow recursion in binfmt_script and binfmt_misc 2008-12-13 15:29:33 -08:00
binfmt_flat.c flat: fix uninitialized ptr with shared libs 2009-08-16 14:27:15 -07:00
binfmt_misc.c Allow recursion in binfmt_script and binfmt_misc 2008-12-13 15:29:33 -08:00
binfmt_script.c Allow recursion in binfmt_script and binfmt_misc 2008-12-13 15:29:33 -08:00
binfmt_som.c tracehook: exec 2008-07-26 12:00:08 -07:00
bio-integrity.c bio-integrity: remove EXPORT_SYMBOL for bio_integrity_init_slab() 2008-07-28 16:30:21 -07:00
bio.c bio: take care not overflow page count when mapping/copying user data 2010-12-09 13:24:17 -08:00
block_dev.c [PATCH] switch mtd and dm-table to lookup_bdev() 2008-08-01 11:25:31 -04:00
buffer.c mm: close page_mkwrite races 2009-05-19 22:20:09 -07:00
char_dev.c Remove the lock_kernel() call from chrdev_open() 2008-06-20 14:05:53 -06:00
compat_binfmt_elf.c x86: compat_binfmt_elf 2008-01-30 13:31:46 +01:00
compat_ioctl.c Revert "compat_ioctl: hook up compat handler for FIEMAP ioctl" 2009-08-17 08:15:28 -07:00
compat.c exec: copy-and-paste the fixes into compat_do_execve() paths 2011-04-30 16:53:36 +02:00
dcache.c fix switch_names() breakage in short-to-short case 2009-01-18 10:35:41 -08:00
dcookies.c System call wrapper special cases 2009-01-18 10:35:34 -08:00
direct-io.c dio: use get_user_pages_fast 2008-07-26 12:00:06 -07:00
dnotify.c [PATCH] split linux/file.h 2008-05-01 13:08:16 -04:00
dquot.c quota: Don't write quota info in dquot_commit() 2011-04-30 16:53:28 +02:00
drop_caches.c vfs: skip I_CLEAR state inodes 2009-05-02 10:24:01 -07:00
eventfd.c System call wrappers part 32 2009-01-18 10:35:40 -08:00
eventpoll.c epoll: fix size check in epoll_create() 2009-05-19 22:20:13 -07:00
exec.c exec: copy-and-paste the fixes into compat_do_execve() paths 2011-04-30 16:53:36 +02:00
fcntl.c Fix race in tty_fasync() properly 2010-04-01 15:52:16 -07:00
fifo.c [PATCH] reuse xxx_fifo_fops for xxx_pipe_fops 2008-07-26 20:53:06 -04:00
file_table.c [PATCH] f_count may wrap around 2008-07-26 20:53:40 -04:00
file.c [PATCH] merge locate_fd() and get_unused_fd() 2008-08-01 11:25:23 -04:00
filesystems.c System call wrappers part 27 2009-01-18 10:35:39 -08:00
fs-writeback.c vfs: skip I_CLEAR state inodes 2009-05-02 10:24:01 -07:00
generic_acl.c
inode.c fs: make sure data stored into inode is properly seen before unlocking new inode 2009-10-05 08:11:38 -07:00
inotify_user.c inotify: clean up inotify_read and fix locking problems 2009-02-02 08:28:07 -08:00
inotify.c inotify: fix GFP_KERNEL related deadlock 2009-03-16 17:52:53 -07:00
internal.h [PATCH] move a bunch of declarations to fs/internal.h 2008-04-21 23:11:01 -04:00
ioctl.c System call wrappers part 15 2009-01-18 10:35:37 -08:00
ioprio.c System call wrappers part 28 2009-01-18 10:35:39 -08:00
Kconfig [CIFS] Reorder cifs config item for better clarity 2008-08-26 18:32:28 +00:00
Kconfig.binfmt sh: Initial ELF FDPIC support. 2008-07-28 18:10:28 +09:00
libfs.c fs: symlink write_begin allocation context fix 2009-01-18 10:35:43 -08:00
locks.c System call wrappers part 16 2009-01-18 10:35:37 -08:00
Makefile omfs: update kbuild to include OMFS 2008-07-26 12:00:05 -07:00
mbcache.c vfs: fix possible deadlock in ext2, ext3, ext4 when using xattrs 2008-04-15 19:35:41 -07:00
mpage.c vfs: add hooks for ext4's delayed allocation support 2008-07-11 19:27:31 -04:00
namei.c fix LOOKUP_FOLLOW on automount "symlinks" 2010-04-01 15:52:25 -07:00
namespace.c vfs: add NOFOLLOW flag to umount(2) 2010-07-05 11:08:46 -07:00
nfsctl.c System call wrappers part 27 2009-01-18 10:35:39 -08:00
no-block.c
open.c System call wrappers part 30 2009-01-18 10:35:39 -08:00
pipe.c fs: pipe.c null pointer dereference 2009-11-09 16:52:02 -08:00
pnode.c [patch 7/7] vfs: mountinfo: show dominating group id 2008-04-23 00:05:09 -04:00
pnode.h [patch 7/7] vfs: mountinfo: show dominating group id 2008-04-23 00:05:09 -04:00
posix_acl.c
quota_v1.c quota: move function-macros from quota.h to quotaops.h 2008-07-25 10:53:35 -07:00
quota_v2.c quota: move function-macros from quota.h to quotaops.h 2008-07-25 10:53:35 -07:00
quota.c System call wrappers part 20 2009-01-18 10:35:38 -08:00
read_write.c System call wrappers part 20 2009-01-18 10:35:38 -08:00
read_write.h
readdir.c System call wrappers part 32 2009-01-18 10:35:40 -08:00
select.c System call wrappers part 32 2009-01-18 10:35:40 -08:00
seq_file.c seq_file: properly cope with pread 2009-03-16 17:52:43 -07:00
signalfd.c signalfd: fill in ssi_int for posix timers and message queues 2010-08-13 13:50:37 -07:00
splice.c splice: fix misuse of SPLICE_F_NONBLOCK 2010-08-13 13:50:34 -07:00
stack.c
stat.c System call wrappers part 30 2009-01-18 10:35:39 -08:00
super.c System call wrappers part 11 2009-01-18 10:35:36 -08:00
sync.c mm: do_sync_mapping_range integrity fix 2009-01-24 16:36:28 -08:00
timerfd.c timerfd: add flags check 2009-03-16 17:52:47 -07:00
utimes.c System call wrappers part 30 2009-01-18 10:35:39 -08:00
xattr_acl.c
xattr.c System call wrappers part 13 2009-01-18 10:35:36 -08:00