Sasha Levin e9a7f3230d nfsd: Fix oops when parsing a 0 length export ... commit b2ea70afad upstream. expkey_parse() oopses when handling a 0 length export. This is easily triggerable from usermode by writing 0 bytes into '/proc/[proc id]/net/rpc/nfsd.fh/channel'. Below is the log: [ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff [ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160 [ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 1402.287632] CPU 1 [ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6 [ 1402.287632] RIP: 0010:[<ffffffff812b4b99>] [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292 [ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400 [ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0 [ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000 [ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000 [ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0 [ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000 [ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0 [ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0) [ 1402.287632] Stack: [ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e [ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0 [ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63 [ 1402.287632] Call Trace: [ 1402.287632] [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc [ 1402.287632] [<ffffffff81111f63>] ? might_fault+0x97/0x9e [ 1402.287632] [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e [ 1402.287632] [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f [ 1402.287632] [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130 [ 1402.287632] [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a [ 1402.287632] [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b [ 1402.287632] [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad [ 1402.287632] [<ffffffff8113fe81>] vfs_write+0xaa/0xfd [ 1402.287632] [<ffffffff8114142d>] ? fget_light+0x35/0x9e [ 1402.287632] [<ffffffff8113ff8b>] sys_write+0x48/0x6f [ 1402.287632] [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b [ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff [ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85 [ 1402.287632] RIP [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] RSP <ffff880077f0fd68> [ 1402.287632] CR2: ffff880077c49fff [ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]--- Cc: "J. Bruce Fields" <bfields@fieldses.org> Cc: Neil Brown <neilb@suse.de> Cc: linux-nfs@vger.kernel.org Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Willy Tarreau <w@1wt.eu>		2012-02-11 15:38:30 +01:00
..
auth.c	nfsd: fix sparse warnings	2008-04-23 16:13:39 -04:00
auth.h	nfsd: minor fs/nfsd/auth.h cleanup	2008-02-01 16:42:05 -05:00
export.c	nfsd: Fix oops when parsing a 0 length export	2012-02-11 15:38:30 +01:00
lockd.c	nfsd: fix auth_domain reference leak on nlm operations	2011-04-30 16:53:34 +02:00
Makefile	knfsd: trivial makefile cleanup	2007-05-09 12:30:54 -07:00
nfs2acl.c	nfsd: rename MAY_ flags	2008-06-23 13:02:50 -04:00
nfs3acl.c	nfsd: rename MAY_ flags	2008-06-23 13:02:50 -04:00
nfs3proc.c	Short write in nfsd becomes a full write to the client	2009-09-24 08:47:40 -07:00
nfs3xdr.c	nfsd: Fix possible BUG_ON firing in set_change_info	2011-02-09 22:15:37 +01:00
nfs4acl.c	nfsd: fix buffer overrun decoding NFSv4 acl	2008-09-01 14:24:24 -04:00
nfs4callback.c	rpc: bring back cl_chatty	2008-07-09 12:09:10 -04:00
nfs4idmap.c	nfsd: fix sparse warnings	2008-04-23 16:13:39 -04:00
nfs4proc.c	Short write in nfsd becomes a full write to the client	2009-09-24 08:47:40 -07:00
nfs4recover.c	[PATCH] r/o bind mounts: get callers of vfs_mknod/create/mkdir()	2008-04-19 00:25:34 -04:00
nfs4state.c	nfsd: only set file_lock.fl_lmops in nfsd4_lockt if a stateowner is found	2009-02-06 14:00:38 -08:00
nfs4xdr.c	nfsd: correctly handle return value from nfsd_map_name_to_*	2011-04-30 16:53:06 +02:00
nfscache.c	nfsd: fail module init on reply cache init failure	2008-02-01 16:42:04 -05:00
nfsctl.c	[PATCH] get rid of indirect users of namei.h	2008-07-26 20:53:42 -04:00
nfsfh.c	[PATCH] kill nameidata passing to permission(), rename to inode_permission()	2008-07-26 20:53:31 -04:00
nfsproc.c	Short write in nfsd becomes a full write to the client	2009-09-24 08:47:40 -07:00
nfssvc.c	NFSD: don't report compiled-out versions as present	2010-07-05 11:08:41 -07:00
nfsxdr.c	Use struct path in struct svc_export	2008-02-14 21:17:08 -08:00
stats.c	[PATCH] knfsd: nfsd4: add per-operation server stats	2006-07-10 13:24:27 -07:00
vfs.c	Open with O_CREAT flag set fails to open existing files on non writable directories	2012-02-11 15:37:18 +01:00