2012-04-06 21:56:38

by Mkrtchyan, Tigran

Subject: corrupted rpc message on GSS_DESTROY

Hi,

We are still see issued described in:

http://www.spinics.net/lists/linux-nfs/msg22142.html

Now even the see partial context.
By looking at kernel's GSS implementation I see following:

The auth_gss.c:gss_marshal() in some cases may return NULL.
The NULL value is passed to xdr_adjust_iovec() which
calculates message length as:

return iov->iov_len = ((u8 *) p - (u8 *) iov->iov_base);

where p is NULL in such case. I don't think it's an expected
behavior.

Regards,
Tigran

2012-04-08 18:08:05

by Myklebust, Trond

Subject: Re: corrupted rpc message on GSS_DESTROY

T24gRnJpLCAyMDEyLTA0LTA2IGF0IDIzOjU2ICswMjAwLCBUaWdyYW4gTWtydGNoeWFuIHdyb3Rl
Og0KPiBIaSwNCj4gDQo+IFdlIGFyZSBzdGlsbCBzZWUgaXNzdWVkIGRlc2NyaWJlZCBpbjoNCj4g
DQo+IGh0dHA6Ly93d3cuc3Bpbmljcy5uZXQvbGlzdHMvbGludXgtbmZzL21zZzIyMTQyLmh0bWwN
Cj4gDQo+IE5vdyBldmVuIHRoZSBzZWUgcGFydGlhbCBjb250ZXh0Lg0KPiBCeSBsb29raW5nIGF0
IGtlcm5lbCdzIEdTUyBpbXBsZW1lbnRhdGlvbiBJIHNlZSBmb2xsb3dpbmc6DQo+IA0KPiBUaGUg
YXV0aF9nc3MuYzpnc3NfbWFyc2hhbCgpIGluIHNvbWUgY2FzZXMgbWF5IHJldHVybiBOVUxMLg0K
PiBUaGUgTlVMTCB2YWx1ZSBpcyBwYXNzZWQgdG8geGRyX2FkanVzdF9pb3ZlYygpIHdoaWNoDQo+
IGNhbGN1bGF0ZXMgbWVzc2FnZSBsZW5ndGggYXM6DQo+IA0KPiAgcmV0dXJuIGlvdi0+aW92X2xl
biA9ICgodTggKikgcCAtICh1OCAqKSBpb3YtPmlvdl9iYXNlKTsNCj4gDQo+IHdoZXJlIHAgaXMg
TlVMTCBpbiBzdWNoIGNhc2UuICBJIGRvbid0IHRoaW5rIGl0J3MgYW4gZXhwZWN0ZWQNCj4gYmVo
YXZpb3IuDQoNCkFzIGZhciBhcyBJIGNhbiBzZWUsIGEgemVybyByZXBseSBpbiBnc3NfbWFyc2hh
bCgpIHJlc3VsdHMgaW4NCnJwY194ZHJfZW5jb2RlKCkgcHJpbnRpbmcgIlJQQzogY291bGRuJ3Qg
ZW5jb2RlIFJQQyBoZWFkZXIsIGV4aXQgRUlPIg0KYW5kIHRoZW4gY2FsbGluZyBycGNfZXhpdCgp
LiBJIGRvbid0IHNlZSBob3cgdGhhdCBjb3VsZCByZXN1bHQgaW4gYQ0KY29ycnVwdGVkIGJ1ZmZl
ci4NCg0KQ2hlZXJzDQogIFRyb25kDQotLSANClRyb25kIE15a2xlYnVzdA0KTGludXggTkZTIGNs
aWVudCBtYWludGFpbmVyDQoNCk5ldEFwcA0KVHJvbmQuTXlrbGVidXN0QG5ldGFwcC5jb20NCnd3
dy5uZXRhcHAuY29tDQoNCg==

2012-04-08 18:17:28

by Mkrtchyan, Tigran

Subject: Re: corrupted rpc message on GSS_DESTROY

On Sun, Apr 8, 2012 at 8:07 PM, Myklebust, Trond
<[email protected]> wrote:
> On Fri, 2012-04-06 at 23:56 +0200, Tigran Mkrtchyan wrote:
>> Hi,
>>
>> We are still see issued described in:
>>
>> http://www.spinics.net/lists/linux-nfs/msg22142.html
>>
>> Now even the see partial context.
>> By looking at kernel's GSS implementation I see following:
>>
>> The auth_gss.c:gss_marshal() in some cases may return NULL.
>> The NULL value is passed to xdr_adjust_iovec() which
>> calculates message length as:
>>
>>  return iov->iov_len = ((u8 *) p - (u8 *) iov->iov_base);
>>
>> where p is NULL in such case.  I don't think it's an expected
>> behavior.
>
> As far as I can see, a zero reply in gss_marshal() results in
> rpc_xdr_encode() printing "RPC: couldn't encode RPC header, exit EIO"
> and then calling rpc_exit(). I don't see how that could result in a
> corrupted buffer.

may be they are unrelated. I will keep looking.

Tigran.
>
> Cheers
>  Trond
> --
> Trond Myklebust
> Linux NFS client maintainer
>
> NetApp
> [email protected]
> http://www.netapp.com
>