DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2CDE0224E0
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: NULL dereference in rpcauth_lookup_credcache
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <b38d91d9e72944bf6908edb44ef5555eafc9ff98.camel@hammerspace.com>
Date:   Mon, 12 Nov 2018 16:17:04 -0800
Cc:     "bfields@fieldses.org" <bfields@fieldses.org>,
        "schumakeranna@gmail.com" <schumakeranna@gmail.com>,
        "chucklever@gmail.com" <chucklever@gmail.com>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <BB402AA8-1F8D-4343-BA26-186DDB498E2E@oracle.com>
References: <20181108214452.GH6090@fieldses.org> <04114B00-B5A8-4F8A-B052-A266AED7725D@gmail.com> <20181110214939.GA16755@fieldses.org> <c986450a2d19fa796078ed51b9d0fb8a79eda696.camel@hammerspace.com> <20181112182454.GE16755@fieldses.org> <2e62a77385b4e5d91e2ca9128313cf817c46a1ae.camel@hammerspace.com> <20181112230149.GF16755@fieldses.org> <9d36177854ba176f46e7a9842aa0368cc508b599.camel@hammerspace.com> <8B4BB2AC-D94B-4B76-BFF2-460303C8FE9B@oracle.com> <b38d91d9e72944bf6908edb44ef5555eafc9ff98.camel@hammerspace.com>
To:     Trond Myklebust <trondmy@hammerspace.com>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


> On Nov 12, 2018, at 4:08 PM, Trond Myklebust <trondmy@hammerspace.com> wro=
te:
>=20
> On Mon, 2018-11-12 at 16:00 -0800, Chuck Lever wrote:
>>> On Nov 12, 2018, at 3:57 PM, Trond Myklebust <
>>> trondmy@hammerspace.com> wrote:
>>>=20
>>>>> On Mon, 2018-11-12 at 18:01 -0500, bfields@fieldses.org wrote:
>>>>> On Mon, Nov 12, 2018 at 09:17:16PM +0000, Trond Myklebust
>>>>> wrote:
>>>>>> On Mon, 2018-11-12 at 13:24 -0500, bfields@fieldses.org
>>>>>> wrote:
>>>>>>> On Mon, Nov 12, 2018 at 05:59:33PM +0000, Trond Myklebust
>>>>>>> wrote:
>>>>>>>> On Sat, 2018-11-10 at 16:49 -0500, Bruce Fields wrote:
>>>>>>>> Looks like it's the fault of
>>>>>>>>=20
>>>>>>>> 07d02a67b7faae "SUNRPC: Simplify lookup code"
>>>>>>>=20
>>>>>>> I'm having trouble reproducing this bug. I've tried both
>>>>>>> cthon
>>>>>>> and
>>>>>>> xfstests in a loop, so far without success (both NFSv3 and
>>>>>>> v4.1,
>>>>>>> but
>>>>>>> only sec=3Dsys). Is there anything else you're doing that I
>>>>>>> might
>>>>>>> try?
>>>>>>>=20
>>>>>>> e.g. Are you running multiple workloads in parallel?
>>>>>>> Different
>>>>>>> users?..
>>>>>>=20
>>>>>> Nothing that interesting.  Currently it's connectathon over
>>>>>> v4,
>>>>>> v3,
>>>>>> v4/krb5, v3/krb5, v4/krb5i, v4/krb5p, v4.1, v4.1/krb5, but
>>>>>> just
>>>>>> serially
>>>>>> one after the other.  Then some pynfs tests (which bypass the
>>>>>> client),
>>>>>> then xfstests over v4.2/sys.  And also a few one-off locking
>>>>>> tests of
>>>>>> my
>>>>>> own that probably aren't a factor here.
>>>>>>=20
>>>>>> (Hah, I just realized I was mounting with vers=3D4 and assuming
>>>>>> that
>>>>>> meant
>>>>>> 4.0, but actually it's changed over time depending on the
>>>>>> defaults,
>>>>>> so
>>>>>> currently those "v4" runs are actually all 4.2.  Gah.)
>>>>>=20
>>>>> Are you perhaps both using RPCSEC_GSS w/ integrity checking for
>>>>> your
>>>>> EXCHANGE_ID authentication? The client will attempt to use that
>>>>> by
>>>>> default if rpc.gssd is running.
>>>>=20
>>>> Yes, in addition to the krb5i mount I'd expect the sys/krb5/krb5p
>>>> mounts
>>>> are using krb5i for EXCHANGE_ID.
>>>>=20
>>>>> I ask because I think the issue might be with RPCSEC_GSS,
>>>>> specifically
>>>>> with the RPCSEC_GSS context destroy code, hence the 2 patches
>>>>> that
>>>>> I
>>>>> just sent out.
>>>>=20
>>>> Looks like my tests pass after applying those two patches.
>>>>=20
>>>=20
>>> Cool! Thanks for testing.
>>>=20
>>> Chuck, do you think the above might also explain your sighting of
>>> the
>>> same Oops?
>>=20
>> Could be, I don=E2=80=99t think I saw it until I started testing NFSv4.
>> I won=E2=80=99t be able to confirm that until next week.
>>=20
>=20
> OK. Either way, I know that part of the GSS code needs to be fixed in
> order to deal with the reference count being 0, so I think it is worth
> merging this patch now, and then we can see if there is more to the
> regression when you can get back to your test rig.

Sounds fine to me.


> Thanks
>  Trond
> --=20
> Trond Myklebust
> Linux NFS client maintainer, Hammerspace
> trond.myklebust@hammerspace.com
>=20
>=20