2007-03-02 23:50:56

by Frank Filz

[permalink] [raw]
Subject: NULL pointer dereference when a process is exited while holding delegations

I am seeing an exception with a NULL pointer with the following stack
(on a 2.6.9 kernel):

Stack:
_spin_lock_irq+0x28/0x8c
sigprocmask+0x44/0xe8
rpc_save_sigmask+0x3c/0x50 [sunrpc]
rpc_call_sync+0x74/0xf0 [sunrpc]
_nfs4_proc_getattr+0x9c/0xc0 [nfs]
nfs4_proc_getattr+0x40/0x7c [nfs]
__nfs_revalidate_inode+0x190/0x354 [nfs]
nfs_do_return_delegation+0x34/0x74 [nfs]
__nfs_inode_return_delegation+0x1cc/0x210 [nfs]
nfs_dentry_iput+0x3c/0x100 [nfs]
prune_dcache+0x490/0x5c0
shrink_dcache_parent+0x20/0x44
proc_pid_flush+0x40/0x68
release_task+0x160/0x1d4
exit_notify+0x394/0x3c4
do_exit+0x6fc/0x748
next_thread+0x0/0x50
syscall_exit+0x0/0x18

What seems to be happening is that release_task has done
__exit_sighand(p), which sets current->sighand to NULL. Then the dcache
is pruned, and eventually a delegation is to be returned. This makes an
RPC call which then ends up calling sigprocmask, which calls
spin_lock_irq(&current->sighand->siglock), resulting in the NULL pointer
dereference.

Has this problem been seen before? If not, any ideas on how to make sure
no RPC calls get made after the sighand is set to NULL?

Thanks for any thoughts,

Frank Filz



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs