Re: [PATCH] nfsd4: Fix kernel crash when reading proc file reply_cache_stats
On Tue, Aug 06, 2019 at 05:41:04PM +0800, zhe...@windriver.com wrote:
> From: He Zhe
>
> reply_cache_stats uses wrong parameter as seq file private structure and
> thus causes the following kernel crash when users read
> /proc/fs/nfsd/reply_cache_stats
Thanks, applying for 5.3.
--b.
>
> BUG: kernel NULL pointer dereference, address: 01f9
> PGD 0 P4D 0
> Oops: [#3] SMP PTI
> CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1
> Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge,
> BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015
> RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
> Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
> d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00
> 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
> RSP: 0018:aa520106fe08 EFLAGS: 00010246
> RAX: 00cfe1a77123 RBX: RCX: 00291b46
> RDX: 00cf RSI: 0006 RDI: 00291b28
> RBP: aa520106fe20 R08: 0006 R09: 00cfe17e55dd
> R10: a424e47c R11: 030b R12: 0001
> R13: a424e5697000 R14: 0001 R15: a424e5697000
> FS: 7f805735f580() GS:a424f8f8() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 01f9 CR3: 655ce005 CR4: 003606e0
> Call Trace:
> seq_read+0x194/0x3e0
> __vfs_read+0x1b/0x40
> vfs_read+0x95/0x140
> ksys_read+0x61/0xe0
> __x64_sys_read+0x1a/0x20
> do_syscall_64+0x4d/0x120
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7f805728b861
> Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00
> 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77
> 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54
> RSP: 002b:7ffea1ce3c38 EFLAGS: 0246 ORIG_RAX:
> RAX: ffda RBX: 0002 RCX: 7f805728b861
> RDX: 0002 RSI: 7f8057183000 RDI: 0003
> RBP: 7f8057183000 R08: 7f8057182010 R09:
> R10: 0022 R11: 0246 R12: 559a60e8ff10
> R13: 0003 R14: 0002 R15: 0002
> Modules linked in:
> CR2: 01f9
> ---[ end trace 01613595153f0cba ]---
> RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
> Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
> d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00
> 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
> RSP: 0018:aa52004b3e08 EFLAGS: 00010246
> RAX: 002bab45a7c6 RBX: RCX: 00291b4c
> RDX: 002b RSI: 0004 RDI: 00291b28
> RBP: aa52004b3e20 R08: 0004 R09: 002bab1c8c7a
> R10: a424e550 R11: 02a9 R12: 0001
> R13: a424e4475000 R14: 0001 R15: a424e4475000
> FS: 7f805735f580() GS:a424f8f8() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 01f9 CR3: 655ce005 CR4: 003606e0
> Killed
>
> Fixes: 3ba75830ce17 ("nfsd4: drc containerization")
> Signed-off-by: He Zhe
> ---
> fs/nfsd/nfscache.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
> index 26ad75a..96352ab 100644
> --- a/fs/nfsd/nfscache.c
> +++ b/fs/nfsd/nfscache.c
> @@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec
> *data)
> */
> static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
> {
> - struct nfsd_net *nn = v;
> + struct nfsd_net *nn = m->private;
>
> seq_printf(m, "max entries: %u\n", nn->max_drc_entries);
> seq_printf(m, "num entries: %u\n",
> --
> 2.7.4
Re: [PATCH] nfsd4: Fix kernel crash when reading proc file reply_cache_stats
Please ignore this one. Resent.
Thanks,
Zhe
On 8/6/19 5:38 PM, zhe...@windriver.com wrote:
> From: He Zhe
>
> reply_cache_stats uses wrong parameter as seq file private structure and
> thus causes the following kernel crash when users read
> /proc/fs/nfsd/reply_cache_stats
>
> m=a2ec03f7 v=f5777155
> BUG: kernel NULL pointer dereference, address: 01f9
> PGD 0 P4D 0
> Oops: [#3] SMP PTI
> CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1
> Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge,
> BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015
> RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
> Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
> d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00
> 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
> RSP: 0018:aa520106fe08 EFLAGS: 00010246
> RAX: 00cfe1a77123 RBX: RCX: 00291b46
> RDX: 00cf RSI: 0006 RDI: 00291b28
> RBP: aa520106fe20 R08: 0006 R09: 00cfe17e55dd
> R10: a424e47c R11: 030b R12: 0001
> R13: a424e5697000 R14: 0001 R15: a424e5697000
> FS: 7f805735f580() GS:a424f8f8() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 01f9 CR3: 655ce005 CR4: 003606e0
> Call Trace:
> seq_read+0x194/0x3e0
> __vfs_read+0x1b/0x40
> vfs_read+0x95/0x140
> ksys_read+0x61/0xe0
> __x64_sys_read+0x1a/0x20
> do_syscall_64+0x4d/0x120
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7f805728b861
> Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00
> 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77
> 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54
> RSP: 002b:7ffea1ce3c38 EFLAGS: 0246 ORIG_RAX:
> RAX: ffda RBX: 0002 RCX: 7f805728b861
> RDX: 0002 RSI: 7f8057183000 RDI: 0003
> RBP: 7f8057183000 R08: 7f8057182010 R09:
> R10: 0022 R11: 0246 R12: 559a60e8ff10
> R13: 0003 R14: 0002 R15: 0002
> Modules linked in:
> CR2: 01f9
> ---[ end trace 01613595153f0cba ]---
> RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
> Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
> d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00
> 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
> RSP: 0018:aa52004b3e08 EFLAGS: 00010246
> RAX: 002bab45a7c6 RBX: RCX: 00291b4c
> RDX: 002b RSI: 0004 RDI: 00291b28
> RBP: aa52004b3e20 R08: 0004 R09: 002bab1c8c7a
> R10: a424e550 R11: 02a9 R12: 0001
> R13: a424e4475000 R14: 0001 R15: a424e4475000
> FS: 7f805735f580() GS:a424f8f8() knlGS:
> CS: 0010 DS: ES: CR0: 80050033
> CR2: 01f9 CR3: 655ce005 CR4: 003606e0
> Killed
>
> Fixes: 3ba75830ce17 ("nfsd4: drc containerization")
> Signed-off-by: He Zhe
> ---
> fs/nfsd/nfscache.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
> index 26ad75a..96352ab 100644
> --- a/fs/nfsd/nfscache.c
> +++ b/fs/nfsd/nfscache.c
> @@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec
> *data)
> */
> static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
> {
> - struct nfsd_net *nn = v;
> + struct nfsd_net *nn = m->private;
>
> seq_printf(m, "max entries: %u\n", nn->max_drc_entries);
> seq_printf(m, "num entries: %u\n",
[PATCH] nfsd4: Fix kernel crash when reading proc file reply_cache_stats
From: He Zhe
reply_cache_stats uses wrong parameter as seq file private structure and
thus causes the following kernel crash when users read
/proc/fs/nfsd/reply_cache_stats
BUG: kernel NULL pointer dereference, address: 01f9
PGD 0 P4D 0
Oops: [#3] SMP PTI
CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1
Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS
BDW-E2R1.86C.0118.R01.1503110618 03/11/2015
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00
48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
RSP: 0018:aa520106fe08 EFLAGS: 00010246
RAX: 00cfe1a77123 RBX: RCX: 00291b46
RDX: 00cf RSI: 0006 RDI: 00291b28
RBP: aa520106fe20 R08: 0006 R09: 00cfe17e55dd
R10: a424e47c R11: 030b R12: 0001
R13: a424e5697000 R14: 0001 R15: a424e5697000
FS: 7f805735f580() GS:a424f8f8() knlGS:
CS: 0010 DS: ES: CR0: 80050033
CR2: 01f9 CR3: 655ce005 CR4: 003606e0
Call Trace:
seq_read+0x194/0x3e0
__vfs_read+0x1b/0x40
vfs_read+0x95/0x140
ksys_read+0x61/0xe0
__x64_sys_read+0x1a/0x20
do_syscall_64+0x4d/0x120
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f805728b861
Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00
00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57
c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54
RSP: 002b:7ffea1ce3c38 EFLAGS: 0246 ORIG_RAX:
RAX: ffda RBX: 0002 RCX: 7f805728b861
RDX: 0002 RSI: 7f8057183000 RDI: 0003
RBP: 7f8057183000 R08: 7f8057182010 R09:
R10: 0022 R11: 0246 R12: 559a60e8ff10
R13: 0003 R14: 0002 R15: 0002
Modules linked in:
CR2: 01f9
---[ end trace 01613595153f0cba ]---
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00
48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
RSP: 0018:aa52004b3e08 EFLAGS: 00010246
RAX: 002bab45a7c6 RBX: RCX: 00291b4c
RDX: 002b RSI: 0004 RDI: 00291b28
RBP: aa52004b3e20 R08: 0004 R09: 002bab1c8c7a
R10: a424e550 R11: 02a9 R12: 0001
R13: a424e4475000 R14: 0001 R15: a424e4475000
FS: 7f805735f580() GS:a424f8f8() knlGS:
CS: 0010 DS: ES: CR0: 80050033
CR2: 01f9 CR3: 655ce005 CR4: 003606e0
Killed
Fixes: 3ba75830ce17 ("nfsd4: drc containerization")
Signed-off-by: He Zhe
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 26ad75a..96352ab 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)
*/
static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
{
- struct nfsd_net *nn = v;
+ struct nfsd_net *nn = m->private;
seq_printf(m, "max entries: %u\n", nn->max_drc_entries);
seq_printf(m, "num entries: %u\n",
--
2.7.4
[PATCH] nfsd4: Fix kernel crash when reading proc file reply_cache_stats
From: He Zhe
reply_cache_stats uses wrong parameter as seq file private structure and
thus causes the following kernel crash when users read
/proc/fs/nfsd/reply_cache_stats
m=a2ec03f7 v=f5777155
BUG: kernel NULL pointer dereference, address: 01f9
PGD 0 P4D 0
Oops: [#3] SMP PTI
CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1
Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS
BDW-E2R1.86C.0118.R01.1503110618 03/11/2015
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00
48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
RSP: 0018:aa520106fe08 EFLAGS: 00010246
RAX: 00cfe1a77123 RBX: RCX: 00291b46
RDX: 00cf RSI: 0006 RDI: 00291b28
RBP: aa520106fe20 R08: 0006 R09: 00cfe17e55dd
R10: a424e47c R11: 030b R12: 0001
R13: a424e5697000 R14: 0001 R15: a424e5697000
FS: 7f805735f580() GS:a424f8f8() knlGS:
CS: 0010 DS: ES: CR0: 80050033
CR2: 01f9 CR3: 655ce005 CR4: 003606e0
Call Trace:
seq_read+0x194/0x3e0
__vfs_read+0x1b/0x40
vfs_read+0x95/0x140
ksys_read+0x61/0xe0
__x64_sys_read+0x1a/0x20
do_syscall_64+0x4d/0x120
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f805728b861
Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00
00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57
c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54
RSP: 002b:7ffea1ce3c38 EFLAGS: 0246 ORIG_RAX:
RAX: ffda RBX: 0002 RCX: 7f805728b861
RDX: 0002 RSI: 7f8057183000 RDI: 0003
RBP: 7f8057183000 R08: 7f8057182010 R09:
R10: 0022 R11: 0246 R12: 559a60e8ff10
R13: 0003 R14: 0002 R15: 0002
Modules linked in:
CR2: 01f9
---[ end trace 01613595153f0cba ]---
RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0
Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82
d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00
48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00
RSP: 0018:aa52004b3e08 EFLAGS: 00010246
RAX: 002bab45a7c6 RBX: RCX: 00291b4c
RDX: 002b RSI: 0004 RDI: 00291b28
RBP: aa52004b3e20 R08: 0004 R09: 002bab1c8c7a
R10: a424e550 R11: 02a9 R12: 0001
R13: a424e4475000 R14: 0001 R15: a424e4475000
FS: 7f805735f580() GS:a424f8f8() knlGS:
CS: 0010 DS: ES: CR0: 80050033
CR2: 01f9 CR3: 655ce005 CR4: 003606e0
Killed
Fixes: 3ba75830ce17 ("nfsd4: drc containerization")
Signed-off-by: He Zhe
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 26ad75a..96352ab 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)
*/
static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
{
- struct nfsd_net *nn = v;
+ struct nfsd_net *nn = m->private;
seq_printf(m, "max entries: %u\n", nn->max_drc_entries);
seq_printf(m, "num entries: %u\n",
--
2.7.4
