summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBruce Ashfield <bruce.ashfield@gmail.com>2019-08-06 23:18:47 -0400
committerBruce Ashfield <bruce.ashfield@gmail.com>2019-08-06 23:18:47 -0400
commitb38d3d337a92a0786bd0f14e2eeffac32ccc08c0 (patch)
tree6fee351d5b585e968013ddbb5505886e146feb1d
parentfffced14aa35cb6b15dead99eb56902ef0c632c4 (diff)
downloadyocto-kernel-cache-b38d3d337a92a0786bd0f14e2eeffac32ccc08c0.tar.gz
yocto-kernel-cache-b38d3d337a92a0786bd0f14e2eeffac32ccc08c0.tar.bz2
yocto-kernel-cache-b38d3d337a92a0786bd0f14e2eeffac32ccc08c0.zip
nfsd4: Fix kernel crash when reading proc file reply_cache_stats
1/1 [ Author: He Zhe Email: zhe.he@windriver.com Subject: nfsd4: Fix kernel crash when reading proc file reply_cache_stats Date: Tue, 6 Aug 2019 17:48:52 +0800 reply_cache_stats uses wrong parameter as seq file private structure and thus causes the following kernel crash when users read /proc/fs/nfsd/reply_cache_stats BUG: kernel NULL pointer dereference, address: 00000000000001f9 PGD 0 P4D 0 Oops: 0000 [#3] SMP PTI CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1 Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015 RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 RSP: 0018:ffffaa520106fe08 EFLAGS: 00010246 RAX: 000000cfe1a77123 RBX: 0000000000000000 RCX: 0000000000291b46 RDX: 000000cf00000000 RSI: 0000000000000006 RDI: 0000000000291b28 RBP: ffffaa520106fe20 R08: 0000000000000006 R09: 000000cfe17e55dd R10: ffffa424e47c0000 R11: 000000000000030b R12: 0000000000000001 R13: ffffa424e5697000 R14: 0000000000000001 R15: ffffa424e5697000 FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 Call Trace: seq_read+0x194/0x3e0 __vfs_read+0x1b/0x40 vfs_read+0x95/0x140 ksys_read+0x61/0xe0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f805728b861 Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54 RSP: 002b:00007ffea1ce3c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f805728b861 RDX: 0000000000020000 RSI: 00007f8057183000 RDI: 0000000000000003 RBP: 00007f8057183000 R08: 00007f8057182010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000559a60e8ff10 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Modules linked in: CR2: 00000000000001f9 ---[ end trace 01613595153f0cba ]--- RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 RSP: 0018:ffffaa52004b3e08 EFLAGS: 00010246 RAX: 0000002bab45a7c6 RBX: 0000000000000000 RCX: 0000000000291b4c RDX: 0000002b00000000 RSI: 0000000000000004 RDI: 0000000000291b28 RBP: ffffaa52004b3e20 R08: 0000000000000004 R09: 0000002bab1c8c7a R10: ffffa424e5500000 R11: 00000000000002a9 R12: 0000000000000001 R13: ffffa424e4475000 R14: 0000000000000001 R15: ffffa424e4475000 FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 Killed Fixes: 3ba75830ce17 ("nfsd4: drc containerization") Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> ] Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
-rw-r--r--features/nfsd/nfsd-enable.scc1
-rw-r--r--features/nfsd/nfsd4-Fix-kernel-crash-when-reading-proc-file-reply_.patch82
2 files changed, 83 insertions, 0 deletions
diff --git a/features/nfsd/nfsd-enable.scc b/features/nfsd/nfsd-enable.scc
index 8a7835dd..ee851527 100644
--- a/features/nfsd/nfsd-enable.scc
+++ b/features/nfsd/nfsd-enable.scc
@@ -2,3 +2,4 @@ define KFEATURE_DESCRIPTION "Enable NFS server support"
define KFEATURE_COMPATIBILITY all
kconf non-hardware nfsd.cfg
+patch nfsd4-Fix-kernel-crash-when-reading-proc-file-reply_.patch
diff --git a/features/nfsd/nfsd4-Fix-kernel-crash-when-reading-proc-file-reply_.patch b/features/nfsd/nfsd4-Fix-kernel-crash-when-reading-proc-file-reply_.patch
new file mode 100644
index 00000000..db426bdf
--- /dev/null
+++ b/features/nfsd/nfsd4-Fix-kernel-crash-when-reading-proc-file-reply_.patch
@@ -0,0 +1,82 @@
+From 31a7feab3b6538a956088d740168bf89b94540c4 Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Tue, 6 Aug 2019 17:48:52 +0800
+Subject: [PATCH] nfsd4: Fix kernel crash when reading proc file
+ reply_cache_stats
+
+reply_cache_stats uses wrong parameter as seq file private structure and
+thus causes the following kernel crash when users read
+/proc/fs/nfsd/reply_cache_stats
+
+BUG: kernel NULL pointer dereference, address: 00000000000001f9
+PGD 0 P4D 0
+Oops: 0000 [#3] SMP PTI
+CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1
+Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015
+RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
+Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
+RSP: 0018:ffffaa520106fe08 EFLAGS: 00010246
+RAX: 000000cfe1a77123 RBX: 0000000000000000 RCX: 0000000000291b46
+RDX: 000000cf00000000 RSI: 0000000000000006 RDI: 0000000000291b28
+RBP: ffffaa520106fe20 R08: 0000000000000006 R09: 000000cfe17e55dd
+R10: ffffa424e47c0000 R11: 000000000000030b R12: 0000000000000001
+R13: ffffa424e5697000 R14: 0000000000000001 R15: ffffa424e5697000
+FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0
+Call Trace:
+ seq_read+0x194/0x3e0
+ __vfs_read+0x1b/0x40
+ vfs_read+0x95/0x140
+ ksys_read+0x61/0xe0
+ __x64_sys_read+0x1a/0x20
+ do_syscall_64+0x4d/0x120
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x7f805728b861
+Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54
+RSP: 002b:00007ffea1ce3c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f805728b861
+RDX: 0000000000020000 RSI: 00007f8057183000 RDI: 0000000000000003
+RBP: 00007f8057183000 R08: 00007f8057182010 R09: 0000000000000000
+R10: 0000000000000022 R11: 0000000000000246 R12: 0000559a60e8ff10
+R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
+Modules linked in:
+CR2: 00000000000001f9
+---[ end trace 01613595153f0cba ]---
+RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
+Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
+RSP: 0018:ffffaa52004b3e08 EFLAGS: 00010246
+RAX: 0000002bab45a7c6 RBX: 0000000000000000 RCX: 0000000000291b4c
+RDX: 0000002b00000000 RSI: 0000000000000004 RDI: 0000000000291b28
+RBP: ffffaa52004b3e20 R08: 0000000000000004 R09: 0000002bab1c8c7a
+R10: ffffa424e5500000 R11: 00000000000002a9 R12: 0000000000000001
+R13: ffffa424e4475000 R14: 0000000000000001 R15: ffffa424e4475000
+FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0
+Killed
+
+Fixes: 3ba75830ce17 ("nfsd4: drc containerization")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+
+Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
+---
+ fs/nfsd/nfscache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
+index 26ad75ae2be0..96352ab7bd81 100644
+--- a/fs/nfsd/nfscache.c
++++ b/fs/nfsd/nfscache.c
+@@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)
+ */
+ static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
+ {
+- struct nfsd_net *nn = v;
++ struct nfsd_net *nn = m->private;
+
+ seq_printf(m, "max entries: %u\n", nn->max_drc_entries);
+ seq_printf(m, "num entries: %u\n",
+--
+2.19.1
+