On Tue, 2017-08-01 at 13:50 -0400, davej@xxxxxxxxxxxxxxxxx wrote:
> On Tue, Aug 01, 2017 at 10:20:31AM -0700, Linus Torvalds wrote:
>
> > So I think the 'pathname' part may actually be entirely a red
> herring,
> > and it's the underlying access itself that just picks up a random
> > pointer from a stack that now contains something different. And
> KASAN
> > didn't notice the stale stack access itself, because the stack
> slot is
> > still valid - it's just no longer the original 'verifier'
> allocation.
> >
> > Or *something* like that.
> >
> > None of this looks even remotely new, though - the code seems to
> go
> > back to 2009. Have you just changed what you're testing to trigger
> > these things?
>
> No idea why it only just showed up, but it isn't 100% reproducable
> either. A month or so ago I did disable the V4 code on the server
> completely (as I was using v3 everywhere else), so maybe I started
> hitting
> a fallback path somewhere. *shrug*
>
I would only expect you too see it if you interrupt the wait on the
asynchronous EXCHANGE_ID call (which would allow the RPC call to
continue while the caller stack is trashed). Prior to commit
8d89bd70bc939, that code path was fully synchronous, so there was no
issue with interrupting the call.
--
Trond Myklebust
Linux NFS client maintainer, PrimaryData
trond.myklebust@xxxxxxxxxxxxxxx
��.n��������+%������w��{.n�����{��w��� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
