Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad86f605 authored by Bill.Baker@oracle.com's avatar Bill.Baker@oracle.com Committed by Trond Myklebust
Browse files

nfs: system crashes after NFS4ERR_MOVED recovery 



nfs4_update_server unconditionally releases the nfs_client for the
source server. If migration fails, this can cause the source server's
nfs_client struct to be left with a low reference count, resulting in
use-after-free.  Also, adjust reference count handling for ELOOP.

NFS: state manager: migration failed on NFSv4 server nfsvmu10 with error 6
WARNING: CPU: 16 PID: 17960 at fs/nfs/client.c:281 nfs_put_client+0xfa/0x110 [nfs]()
	nfs_put_client+0xfa/0x110 [nfs]
	nfs4_run_state_manager+0x30/0x40 [nfsv4]
	kthread+0xd8/0xf0

BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8
	nfs4_xdr_enc_write+0x6b/0x160 [nfsv4]
	rpcauth_wrap_req+0xac/0xf0 [sunrpc]
	call_transmit+0x18c/0x2c0 [sunrpc]
	__rpc_execute+0xa6/0x490 [sunrpc]
	rpc_async_schedule+0x15/0x20 [sunrpc]
	process_one_work+0x160/0x470
	worker_thread+0x112/0x540
	? rescuer_thread+0x3f0/0x3f0
	kthread+0xd8/0xf0

This bug was introduced by 32e62b7c ("NFS: Add nfs4_update_server"),
but the fix applies cleanly to 52442f9b ("NFS4: Avoid migration loops")

Reported-by: default avatarHelen Chao <helen.chao@oracle.com>
Fixes: 52442f9b ("NFS4: Avoid migration loops")
Signed-off-by: default avatarBill Baker <bill.baker@oracle.com>
Reviewed-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent 6d243a23

fs/nfs/nfs4client.c

+4 −2
Original line number Diff line number Diff line
@@ -868,8 +868,10 @@ static int nfs4_set_client(struct nfs_server *server, 
	if (IS_ERR(clp))

		return PTR_ERR(clp);



	if (server->nfs_client == clp)

	if (server->nfs_client == clp) {

		nfs_put_client(clp);

		return -ELOOP;

	}



	/*

	 * Query for the lease time on clientid setup or renewal
@@ -1244,11 +1246,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname, 
				clp->cl_proto, clnt->cl_timeout,

				clp->cl_minorversion, net);

	clear_bit(NFS_MIG_TSM_POSSIBLE, &server->mig_status);

	nfs_put_client(clp);

	if (error != 0) {

		nfs_server_insert_lists(server);

		return error;

	}

	nfs_put_client(clp);



	if (server->nfs_client->cl_hostname == NULL)

		server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);