lkml.org 
[lkml]   [2014]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16 263/357] lockd: fix rpcbind crash on lockd startup failure
    Date
    3.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "J. Bruce Fields" <bfields@redhat.com>

    commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.

    Nikita Yuschenko reported that booting a kernel with init=/bin/sh and
    then nfs mounting without portmap or rpcbind running using a busybox
    mount resulted in:

    # mount -t nfs 10.30.130.21:/opt /mnt
    svc: failed to register lockdv1 RPC service (errno 111).
    lockd_up: makesock failed, error=-111
    Unable to handle kernel paging request for data at address 0x00000030
    Faulting instruction address: 0xc055e65c
    Oops: Kernel access of bad area, sig: 11 [#1]
    MPC85xx CDS
    Modules linked in:
    CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117
    task: cf29cea0 ti: cf35c000 task.ti: cf35c000
    NIP: c055e65c LR: c0566490 CTR: c055e648
    REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge)
    MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000
    DEAR: 00000030, ESR: 00000000

    GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086
    00000000
    GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000
    10090ae8
    GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000
    bfa46ef0
    GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000
    cf0ded80
    NIP [c055e65c] call_start+0x14/0x34
    LR [c0566490] __rpc_execute+0x70/0x250
    Call Trace:
    [cf35db80] [00000080] 0x80 (unreliable)
    [cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4
    [cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8
    [cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84
    [cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c
    [cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108
    [cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30
    [cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0
    [cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8
    [cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec
    [cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4
    [cf35dd90] [c0171590] nfs3_create_server+0x10/0x44
    [cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4
    [cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8
    [cf35de70] [c00cd3bc] mount_fs+0x20/0xbc
    [cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104
    [cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0
    [cf35df10] [c00e75ac] SyS_mount+0x90/0xd0
    [cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c

    The addition of svc_shutdown_net() resulted in two calls to
    svc_rpcb_cleanup(); the second is no longer necessary and crashes when
    it calls rpcb_register_call with clnt=NULL.

    Reported-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
    Fixes: 679b033df484 "lockd: ensure we tear down any live sockets when socket creation fails during lockd_up"
    Acked-by: Jeff Layton <jlayton@primarydata.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/lockd/svc.c | 4 +---
    1 file changed, 1 insertion(+), 3 deletions(-)

    --- a/fs/lockd/svc.c
    +++ b/fs/lockd/svc.c
    @@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv

    error = make_socks(serv, net);
    if (error < 0)
    - goto err_socks;
    + goto err_bind;
    set_grace_period(net);
    dprintk("lockd_up_net: per-net data created; net=%p\n", net);
    return 0;

    -err_socks:
    - svc_rpcb_cleanup(serv, net);
    err_bind:
    ln->nlmsvc_users--;
    return error;



    \
     
     \ /
      Last update: 2014-10-04 00:41    [W:3.102 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site