----- Original Message ----- > From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> > To: Borislav Petkov <bp@xxxxxxxxx>; Linux NFS Mailing List <linux-nfs@xxxxxxxxxxxxxxx> > Cc: John <da_audiophile@xxxxxxxxx>; lkml <linux-kernel@xxxxxxxxxxxxxxx>; "netdev@xxxxxxxxxxxxxxx" <netdev@xxxxxxxxxxxxxxx>; "stephen@xxxxxxxxxxxxxxxxxx" <stephen@xxxxxxxxxxxxxxxxxx>; "mlindner@xxxxxxxxxxx" <mlindner@xxxxxxxxxxx>; J. Bruce Fields <bfields@xxxxxxxxxxxx> > Sent: Sunday, February 16, 2014 12:27 PM > Subject: Re: [BUG] unable to handle kernel NULL pointer dereference > > Please ensure that you post to the linux-nfs@xxxxxxxxxxxxxxx when > reporting NFS and RPC related bugs. > > Does the following patch help? > > 8<------------------------------------------------------------------- > From 0e57b109cd7b17d6e6f16c3454427372a583b18a Mon Sep 17 00:00:00 2001 > From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> > Date: Sun, 16 Feb 2014 12:14:13 -0500 > Subject: [PATCH] SUNRPC: Ensure that gss_auth isn't freed before its upcall > messages > > Fix a race in which the RPC client is shutting down while the > gss daemon is processing a downcall. If the RPC client manages to > shut down before the gss daemon is done, then the struct gss_auth > used in gss_release_msg() may have already been freed. > > Link: > http://lkml.kernel.org/r/1392494917.71728.YahooMailNeo@xxxxxxxxxxxxxxxxxxxxxxxxxxxx > Reported-by: John <da_audiophile@xxxxxxxxx> > Reported-by: Borislav Petkov <bp@xxxxxxxxx> > Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> > --- > net/sunrpc/auth_gss/auth_gss.c | 13 +++++++++++-- > 1 file changed, 11 insertions(+), 2 deletions(-) > > diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c > index 44a61e8fda6f..1ba1fd114912 100644 > --- a/net/sunrpc/auth_gss/auth_gss.c > +++ b/net/sunrpc/auth_gss/auth_gss.c > @@ -108,6 +108,7 @@ struct gss_auth { > static DEFINE_SPINLOCK(pipe_version_lock); > static struct rpc_wait_queue pipe_version_rpc_waitqueue; > static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue); > +static void gss_put_auth(struct gss_auth *gss_auth); > > static void gss_free_ctx(struct gss_cl_ctx *); > static const struct rpc_pipe_ops gss_upcall_ops_v0; > @@ -320,6 +321,7 @@ gss_release_msg(struct gss_upcall_msg *gss_msg) > if (gss_msg->ctx != NULL) > gss_put_ctx(gss_msg->ctx); > rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue); > + gss_put_auth(gss_msg->auth); > kfree(gss_msg); > } > > @@ -500,6 +502,7 @@ gss_alloc_msg(struct gss_auth *gss_auth, > if (err) > goto err_free_msg; > }; > + kref_get(&gss_auth->kref); > return gss_msg; > err_free_msg: > kfree(gss_msg); > @@ -1064,6 +1067,12 @@ gss_free_callback(struct kref *kref) > } > > static void > +gss_put_auth(struct gss_auth *gss_auth) > +{ > + kref_put(&gss_auth->kref, gss_free_callback); > +} > + > +static void > gss_destroy(struct rpc_auth *auth) > { > struct gss_auth *gss_auth = container_of(auth, > @@ -1084,7 +1093,7 @@ gss_destroy(struct rpc_auth *auth) > gss_auth->gss_pipe[1] = NULL; > rpcauth_destroy_credcache(auth); > > - kref_put(&gss_auth->kref, gss_free_callback); > + gss_put_auth(gss_auth); > } > > /* > @@ -1255,7 +1264,7 @@ gss_destroy_nullcred(struct rpc_cred *cred) > call_rcu(&cred->cr_rcu, gss_free_cred_callback); > if (ctx) > gss_put_ctx(ctx); > - kref_put(&gss_auth->kref, gss_free_callback); > + gss_put_auth(gss_auth); > > } > > static void > -- Tested-by: John <da_audiophile@xxxxxxxxx> Fixes the problem on 3.13.3 for me (i686). Thank you. -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
