<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 6, 2019 at 6:49 AM <<a href="mailto:zhe.he@windriver.com">zhe.he@windriver.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: He Zhe <<a href="mailto:zhe.he@windriver.com" target="_blank">zhe.he@windriver.com</a>><br>
<br>
reply_cache_stats uses wrong parameter as seq file private structure and<br>
thus causes the following kernel crash when users read<br>
/proc/fs/nfsd/reply_cache_stats<br>
<br>
BUG: kernel NULL pointer dereference, address: 00000000000001f9<br>
PGD 0 P4D 0<br>
Oops: 0000 [#3] SMP PTI<br>
CPU: 6 PID: 1502 Comm: cat Tainted: GÂ Â Â DÂ Â Â Â Â Â 5.3.0-rc3+ #1<br>
Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015<br>
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0<br>
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00<br>
RSP: 0018:ffffaa520106fe08 EFLAGS: 00010246<br>
RAX: 000000cfe1a77123 RBX: 0000000000000000 RCX: 0000000000291b46<br>
RDX: 000000cf00000000 RSI: 0000000000000006 RDI: 0000000000291b28<br>
RBP: ffffaa520106fe20 R08: 0000000000000006 R09: 000000cfe17e55dd<br>
R10: ffffa424e47c0000 R11: 000000000000030b R12: 0000000000000001<br>
R13: ffffa424e5697000 R14: 0000000000000001 R15: ffffa424e5697000<br>
FS:Â 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000<br>
CS:Â 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br>
CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0<br>
Call Trace:<br>
 seq_read+0x194/0x3e0<br>
 __vfs_read+0x1b/0x40<br>
 vfs_read+0x95/0x140<br>
 ksys_read+0x61/0xe0<br>
 __x64_sys_read+0x1a/0x20<br>
 do_syscall_64+0x4d/0x120<br>
 entry_SYSCALL_64_after_hwframe+0x44/0xa9<br>
RIP: 0033:0x7f805728b861<br>
Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54<br>
RSP: 002b:00007ffea1ce3c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000<br>
RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f805728b861<br>
RDX: 0000000000020000 RSI: 00007f8057183000 RDI: 0000000000000003<br>
RBP: 00007f8057183000 R08: 00007f8057182010 R09: 0000000000000000<br>
R10: 0000000000000022 R11: 0000000000000246 R12: 0000559a60e8ff10<br>
R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000<br>
Modules linked in:<br>
CR2: 00000000000001f9<br>
---[ end trace 01613595153f0cba ]---<br>
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0<br>
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00<br>
RSP: 0018:ffffaa52004b3e08 EFLAGS: 00010246<br>
RAX: 0000002bab45a7c6 RBX: 0000000000000000 RCX: 0000000000291b4c<br>
RDX: 0000002b00000000 RSI: 0000000000000004 RDI: 0000000000291b28<br>
RBP: ffffaa52004b3e20 R08: 0000000000000004 R09: 0000002bab1c8c7a<br>
R10: ffffa424e5500000 R11: 00000000000002a9 R12: 0000000000000001<br>
R13: ffffa424e4475000 R14: 0000000000000001 R15: ffffa424e4475000<br>
FS:Â 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000<br>
CS:Â 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br>
CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0<br>
Killed<br>
<br>
Fixes: 3ba75830ce17 ("nfsd4: drc containerization")<br>
Signed-off-by: He Zhe <<a href="mailto:zhe.he@windriver.com" target="_blank">zhe.he@windriver.com</a>><br>
---<br>
This is for all branches and has also been sent to mainline.<br>
Please consider if it's worth merging in linux-yocto-dev for this moment.<br>
Thanks.<br></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">Looks fine to me.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">For patches like this, it is helpful if you also put a patch to the upstream submission. So on my next updates to the kernel, I'll be able to easily drop (or carry) it.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">This is now merged.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Bruce</div><br></div><div>Â </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
 fs/nfsd/nfscache.c | 2 +-<br>
 1 file changed, 1 insertion(+), 1 deletion(-)<br>
<br>
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c<br>
index 26ad75a..96352ab 100644<br>
--- a/fs/nfsd/nfscache.c<br>
+++ b/fs/nfsd/nfscache.c<br>
@@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)<br>
 */<br>
 static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)<br>
 {<br>
-Â Â Â Â struct nfsd_net *nn = v;<br>
+Â Â Â Â struct nfsd_net *nn = m->private;<br>
<br>
    seq_printf(m, "max entries:      %u\n", nn->max_drc_entries);<br>
    seq_printf(m, "num entries:      %u\n",<br>
-- <br>
2.7.4<br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">- Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end<br>- "Use the force Harry" - Gandalf, Star Trek II<br><br></div></div>