2015-04-17 10:35:31

by Giuseppe Cantavenera

Subject: [PATCH] nfsd: fix: prevent BUG_ON registering rpc_pipefs_event for notifications only after nfsd_net_id is valid

nfsd triggered a BUG_ON in net_generic(...) when rpc_pipefs_event(...)
in fs/nfsd/nfs4recover.c was called before assigning ntfsd_net_id.
The following was observed on a MIPS 32-core processor:
kernel: Call Trace:
kernel: [<ffffffffc00bc5e4>] rpc_pipefs_event+0x7c/0x158 [nfsd]
kernel: [<ffffffff8017a2a0>] notifier_call_chain+0x70/0xb8
kernel: [<ffffffff8017a4e4>] __blocking_notifier_call_chain+0x4c/0x70
kernel: [<ffffffff8053aff8>] rpc_fill_super+0xf8/0x1a0
kernel: [<ffffffff8022204c>] mount_ns+0xb4/0xf0
kernel: [<ffffffff80222b48>] mount_fs+0x50/0x1f8
kernel: [<ffffffff8023dc00>] vfs_kern_mount+0x58/0xf0
kernel: [<ffffffff802404ac>] do_mount+0x27c/0xa28
kernel: [<ffffffff80240cf0>] SyS_mount+0x98/0xe8
kernel: [<ffffffff80135d24>] handle_sys64+0x44/0x68
kernel:
kernel:
Code: 0040f809 00000000 2e020001 <00020336> 3c12c00d 3c02801a de100000 6442eb98 0040f809
kernel: ---[ end trace 7471374335809536 ]---

Fixed this behaviour by calling register_pernet_subsys(&nfsd_net_ops) before
registering rpc_pipefs_event(...) with the notifier chain.

Signed-off-by: Giuseppe Cantavenera <[email protected]>
Signed-off-by: Lorenzo Restelli <[email protected]>
---
fs/nfsd/nfsctl.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index f34d9de..3ee92a4 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1170,15 +1170,15 @@ static int __init init_nfsd(void)
int retval;
printk(KERN_INFO "Installing knfsd (copyright (C) 1996 [email protected]).\n");

- retval = register_cld_notifier();
- if (retval)
- return retval;
retval = register_pernet_subsys(&nfsd_net_ops);
if (retval < 0)
- goto out_unregister_notifier;
- retval = nfsd4_init_slabs();
+ return retval;
+ retval = register_cld_notifier();
if (retval)
goto out_unregister_pernet;
+ retval = nfsd4_init_slabs();
+ if (retval)
+ goto out_unregister_notifier;
nfs4_state_init();
retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
if (retval)
@@ -1206,10 +1206,10 @@ out_free_stat:
nfsd_fault_inject_cleanup();
out_free_slabs:
nfsd4_free_slabs();
-out_unregister_pernet:
- unregister_pernet_subsys(&nfsd_net_ops);
out_unregister_notifier:
unregister_cld_notifier();
+out_unregister_pernet:
+ unregister_pernet_subsys(&nfsd_net_ops);
return retval;
}

@@ -1223,8 +1223,8 @@ static void __exit exit_nfsd(void)
nfsd4_free_slabs();
nfsd_fault_inject_cleanup();
unregister_filesystem(&nfsd_fs_type);
- unregister_pernet_subsys(&nfsd_net_ops);
unregister_cld_notifier();
+ unregister_pernet_subsys(&nfsd_net_ops);
}

MODULE_AUTHOR("Olaf Kirch <[email protected]>");
--
1.9.1

2015-04-17 14:07:48

by Kinglong Mee

Subject: Re: [PATCH] nfsd: fix: prevent BUG_ON registering rpc_pipefs_event for notifications only after nfsd_net_id is valid

On 4/17/2015 6:25 PM, Giuseppe Cantavenera wrote:
> nfsd triggered a BUG_ON in net_generic(...) when rpc_pipefs_event(...)
> in fs/nfsd/nfs4recover.c was called before assigning ntfsd_net_id.
> The following was observed on a MIPS 32-core processor:
> kernel: Call Trace:
> kernel: [<ffffffffc00bc5e4>] rpc_pipefs_event+0x7c/0x158 [nfsd]
> kernel: [<ffffffff8017a2a0>] notifier_call_chain+0x70/0xb8
> kernel: [<ffffffff8017a4e4>] __blocking_notifier_call_chain+0x4c/0x70
> kernel: [<ffffffff8053aff8>] rpc_fill_super+0xf8/0x1a0
> kernel: [<ffffffff8022204c>] mount_ns+0xb4/0xf0
> kernel: [<ffffffff80222b48>] mount_fs+0x50/0x1f8
> kernel: [<ffffffff8023dc00>] vfs_kern_mount+0x58/0xf0
> kernel: [<ffffffff802404ac>] do_mount+0x27c/0xa28
> kernel: [<ffffffff80240cf0>] SyS_mount+0x98/0xe8
> kernel: [<ffffffff80135d24>] handle_sys64+0x44/0x68
> kernel:
> kernel:
> Code: 0040f809 00000000 2e020001 <00020336> 3c12c00d 3c02801a de100000 6442eb98 0040f809
> kernel: ---[ end trace 7471374335809536 ]---
>
> Fixed this behaviour by calling register_pernet_subsys(&nfsd_net_ops) before
> registering rpc_pipefs_event(...) with the notifier chain.
>
> Signed-off-by: Giuseppe Cantavenera <[email protected]>
> Signed-off-by: Lorenzo Restelli <[email protected]>

Make sense,
Reviewed-by: Kinglong Mee <[email protected]>

> ---
> fs/nfsd/nfsctl.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index f34d9de..3ee92a4 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -1170,15 +1170,15 @@ static int __init init_nfsd(void)
> int retval;
> printk(KERN_INFO "Installing knfsd (copyright (C) 1996 [email protected]).\n");
>
> - retval = register_cld_notifier();
> - if (retval)
> - return retval;
> retval = register_pernet_subsys(&nfsd_net_ops);
> if (retval < 0)
> - goto out_unregister_notifier;
> - retval = nfsd4_init_slabs();
> + return retval;
> + retval = register_cld_notifier();
> if (retval)
> goto out_unregister_pernet;
> + retval = nfsd4_init_slabs();
> + if (retval)
> + goto out_unregister_notifier;
> nfs4_state_init();
> retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
> if (retval)
> @@ -1206,10 +1206,10 @@ out_free_stat:
> nfsd_fault_inject_cleanup();
> out_free_slabs:
> nfsd4_free_slabs();
> -out_unregister_pernet:
> - unregister_pernet_subsys(&nfsd_net_ops);
> out_unregister_notifier:
> unregister_cld_notifier();
> +out_unregister_pernet:
> + unregister_pernet_subsys(&nfsd_net_ops);
> return retval;
> }
>
> @@ -1223,8 +1223,8 @@ static void __exit exit_nfsd(void)
> nfsd4_free_slabs();
> nfsd_fault_inject_cleanup();
> unregister_filesystem(&nfsd_fs_type);
> - unregister_pernet_subsys(&nfsd_net_ops);
> unregister_cld_notifier();
> + unregister_pernet_subsys(&nfsd_net_ops);
> }
>
> MODULE_AUTHOR("Olaf Kirch <[email protected]>");
>

2015-04-17 21:22:38

by J. Bruce Fields

Subject: Re: [PATCH] nfsd: fix: prevent BUG_ON registering rpc_pipefs_event for notifications only after nfsd_net_id is valid

On Fri, Apr 17, 2015 at 10:07:41PM +0800, Kinglong Mee wrote:
> On 4/17/2015 6:25 PM, Giuseppe Cantavenera wrote:
> > nfsd triggered a BUG_ON in net_generic(...) when rpc_pipefs_event(...)
> > in fs/nfsd/nfs4recover.c was called before assigning ntfsd_net_id.
> > The following was observed on a MIPS 32-core processor:
> > kernel: Call Trace:
> > kernel: [<ffffffffc00bc5e4>] rpc_pipefs_event+0x7c/0x158 [nfsd]
> > kernel: [<ffffffff8017a2a0>] notifier_call_chain+0x70/0xb8
> > kernel: [<ffffffff8017a4e4>] __blocking_notifier_call_chain+0x4c/0x70
> > kernel: [<ffffffff8053aff8>] rpc_fill_super+0xf8/0x1a0
> > kernel: [<ffffffff8022204c>] mount_ns+0xb4/0xf0
> > kernel: [<ffffffff80222b48>] mount_fs+0x50/0x1f8
> > kernel: [<ffffffff8023dc00>] vfs_kern_mount+0x58/0xf0
> > kernel: [<ffffffff802404ac>] do_mount+0x27c/0xa28
> > kernel: [<ffffffff80240cf0>] SyS_mount+0x98/0xe8
> > kernel: [<ffffffff80135d24>] handle_sys64+0x44/0x68
> > kernel:
> > kernel:
> > Code: 0040f809 00000000 2e020001 <00020336> 3c12c00d 3c02801a de100000 6442eb98 0040f809
> > kernel: ---[ end trace 7471374335809536 ]---
> >
> > Fixed this behaviour by calling register_pernet_subsys(&nfsd_net_ops) before
> > registering rpc_pipefs_event(...) with the notifier chain.
> >
> > Signed-off-by: Giuseppe Cantavenera <[email protected]>
> > Signed-off-by: Lorenzo Restelli <[email protected]>
>
> Make sense,
> Reviewed-by: Kinglong Mee <[email protected]>

Thanks, applying.--b.

>
> > ---
> > fs/nfsd/nfsctl.c | 16 ++++++++--------
> > 1 file changed, 8 insertions(+), 8 deletions(-)
> >
> > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> > index f34d9de..3ee92a4 100644
> > --- a/fs/nfsd/nfsctl.c
> > +++ b/fs/nfsd/nfsctl.c
> > @@ -1170,15 +1170,15 @@ static int __init init_nfsd(void)
> > int retval;
> > printk(KERN_INFO "Installing knfsd (copyright (C) 1996 [email protected]).\n");
> >
> > - retval = register_cld_notifier();
> > - if (retval)
> > - return retval;
> > retval = register_pernet_subsys(&nfsd_net_ops);
> > if (retval < 0)
> > - goto out_unregister_notifier;
> > - retval = nfsd4_init_slabs();
> > + return retval;
> > + retval = register_cld_notifier();
> > if (retval)
> > goto out_unregister_pernet;
> > + retval = nfsd4_init_slabs();
> > + if (retval)
> > + goto out_unregister_notifier;
> > nfs4_state_init();
> > retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
> > if (retval)
> > @@ -1206,10 +1206,10 @@ out_free_stat:
> > nfsd_fault_inject_cleanup();
> > out_free_slabs:
> > nfsd4_free_slabs();
> > -out_unregister_pernet:
> > - unregister_pernet_subsys(&nfsd_net_ops);
> > out_unregister_notifier:
> > unregister_cld_notifier();
> > +out_unregister_pernet:
> > + unregister_pernet_subsys(&nfsd_net_ops);
> > return retval;
> > }
> >
> > @@ -1223,8 +1223,8 @@ static void __exit exit_nfsd(void)
> > nfsd4_free_slabs();
> > nfsd_fault_inject_cleanup();
> > unregister_filesystem(&nfsd_fs_type);
> > - unregister_pernet_subsys(&nfsd_net_ops);
> > unregister_cld_notifier();
> > + unregister_pernet_subsys(&nfsd_net_ops);
> > }
> >
> > MODULE_AUTHOR("Olaf Kirch <[email protected]>");
> >