Re: fuzz tested user mode linux crashed in NFS code path

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Jul 19, 2014 at 12:50 AM, Toralf Förster <toralf.foerster@xxxxxx> wrote:
> On 07/18/2014 06:22 PM, Toralf Förster wrote:
>> I can now try with kzalloc, but due to the nature of this issue I think, that the absence of this crash - even after 2-3 hours - doesn't mean by 100%, that kzalloc fixed it, or ?
>
> Well, next crash (with kzalloc patch) happened after 20 minutes ...

Maybe I have found the problem.
The stateid and denied are defined as an union as,
fs/nfsd/xdr4.h
145 struct nfsd4_lock_denied {
146         clientid_t      ld_clientid;
147         struct xdr_netobj       ld_owner;
148         u64             ld_start;
149         u64             ld_length;
150         u32             ld_type;
151 };
152
153 struct nfsd4_lock {
... ...
174         /* response */
175         union {
176                 struct {
177                         stateid_t               stateid;
178                 } ok;
179                 struct nfsd4_lock_denied        denied;
180         } u;

 30 struct xdr_netobj {
 31         unsigned int            len;
 32         u8 *                    data;
 33 };

sizeof(stateid_t) = 16, sizeof(clientid_t) = 8,
sizeof(struct xdr_netobj) = 16, (on x86_x64 platform),
sizeof(struct xdr_netobj) = 8,  (on i686 platform)

Lock file success, nfsd will copy stateid to the union, but the value
also influence denied.
If on x86_64 platform, only influence the len in xdr_netobj,
but on i686 platform, will influence the len and the data in xdr_netobj.
So, the problem only appears on i686 platform.

thanks,
Kinglong Mee
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux