Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <c2d13c973a2ef364314441503281ba5887a143aa.camel@gmx.de>
Subject: Re: [PATCH 1/1] NFSD: fix WARN_ON_ONCE in __queue_delayed_work
From:   Mike Galbraith <efault@gmx.de>
To:     Jeff Layton <jlayton@kernel.org>, dai.ngo@oracle.com,
        Chuck Lever III <chuck.lever@oracle.com>
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Date:   Wed, 11 Jan 2023 14:48:36 +0100
In-Reply-To: <5f43a396afec99352bc1dd62a9119281e845c652.camel@kernel.org>
References: <1673333310-24837-1-git-send-email-dai.ngo@oracle.com>
         <57dc06d57b4b643b4bf04daf28acca202c9f7a85.camel@kernel.org>
         <71672c07-5e53-31e6-14b1-e067fd56df57@oracle.com>
         <8C3345FB-6EDF-411A-B942-5AFA03A89BA2@oracle.com>
         <5e34288720627d2a09ae53986780b2d293a54eea.camel@kernel.org>
         <42876697-ba42-c38f-219d-f760b94e5fed@oracle.com>
         <f0f56b451287d17426defe77aee1b1240d2a1b31.camel@kernel.org>
         <8e0cb925-9f73-720d-b402-a7204659ff7f@oracle.com>
         <37c80eaf2f6d8a5d318e2b10e737a1c351b27427.camel@gmx.de>
         <ce3724b88bb2987ac773057f523aa0ed2abacaed.camel@kernel.org>
         <2067b4b4ce029ab5be982820b81241cd457ff475.camel@kernel.org>
         <ec6593bce96f8a6a7928394f19419fb8a4725413.camel@gmx.de>
         <fe19401301eac98927d6b4fc9fbf9c8430890751.camel@gmx.de>
         <5f43a396afec99352bc1dd62a9119281e845c652.camel@kernel.org>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:r9duZ0gOB2M=;TRiEFyiOJkXabNhdDhQdFA1rMEo
 QprfeifmXIKlqFe8l2UUKjdE5u+1jnwIykHEr4gbNAZ/dGChfnrg+If1xbD4SIDTiiu1czI6C
 4vlk45NQfVe8vwKttaa8cEg+ObSWCqntjB87LPudH3Ch+rEjJmKmw3ypdaOksG8bzgEz3R+OR
 Q+X/f2DLA80zLmopBp9AWJx1QGu6vLqWQbNhJjZECCvlLZ46x6LQ3gRlpclZha0qO9bSIvhPx
 tNgcQEf3d1EKRxDjH75HvtsWjFvLZhjcYaM9xQ4h4FdMKMCNP8okSC+XZ7BrtHxbe0fnF8Gpp
 LQD8X3WbJk3qs1CjNH4mmZAV+5xWpVl9/PgyahStMiMvZEjd5oCuuqtReasKIUdX+WeROHq0F
 t38Co2qdKMoNbXq3zQHn5h8Dp0g8tu9pxi+8/MCyLPh0Ull4txnF46jmw7F3gjpcNIgFlsLlT
 TDSPwZA5gQDU8Q1rsAQwgOJN+LjUuGFYNqbyPyXGaxP9Rngbc0xvnfOpQsB56SpetbC4TYE5D
 6WlSpK1jfr6nhiycKCQqoOjjh6F7n4hIZGYo0BSBYl8QZiVO3xXTv9MFLK9l6pj4upVpomBQR
 7wm+PVV9PXv9LkVZZZoj+9Utpw8lEHQMIAUUWOp7KoR1AAMytoc8gDSR5HGY+ZdOSyff0cMvi
 HemMgUicTGdFbj4+M8XM+ehbiLey21CWMYTPw6bEiEi2rx1m3B4s0MO7XBJn0JQssHDaIUnmd
 ymqSTSDiEaJ4qOD0vmzRLNywf2rc3R7xDyFUvfnOfQo352ljeM/Qfo27P+4dpLmhN9NH9aLy9
 PNa0qWBgqKJo3dSO4C9qRYfWmZNpz2ZcpKeB8fBdIZlCDdXCk15LHl5eD+eQGWZpdnjb1ZPtE
 0bMc8lUxQztSeybmQu5FLDPgZ8znBxN+gx5EGZYMJ3dvc6F+95X2tkkRNANT6EepFOZWOqa+o
 8AIHImjdSlTOU2aU7BNUSEssro4=
Precedence: bulk

On Wed, 2023-01-11 at 07:33 -0500, Jeff Layton wrote:
>
> One thing that might interesting to rule out a UAF would be to
> explicitly poison this struct in nfsd_exit_net. Basically do something
> like this at the end of exit_net:
>
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0memset(net, 0x7c, sizeof=
(*net));
>
> That might help trigger an oops sooner after the problem occurs.

Blasting net rendered the VM non-booting.  Blasting nn OTOH seems to
have changed nothing at all.

> If you're feeling ambitious, another thing you could do is track down
> some of the running nfsd's in the vmcore, find their rqstp values and
> see whether the sockets are pointed at the same nfsd_net as the one you
> found above (see nfsd() function to see how to get from one to the
> other).
>
> If they're pointed at a different nfsd_net that that would suggest that
> we are looking at a UAF. If it's the same nfsd_net, then I'd lean more
> toward some sort of memory scribble.

Way better: scrawny NFS chimp hands dump to big/strong NFS gorilla :)

	-Mike