Yanjun Zhang f892165c56 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() ... [ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ] On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog: [232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye! Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as: PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp" #0 [ffff8001116ef740] __switch_to at ffff8000081b92f4 #1 [ffff8001116ef760] __schedule at ffff800008dd0650 #2 [ffff8001116ef7c0] schedule at ffff800008dd0a00 #3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0 #4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c #5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4] #7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4] #8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4] #9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4] The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially. Fixes: 0e65a32c8a ("NFS: handle source server reboot") Signed-off-by: Yanjun Zhang <zhangyanjun@cestc.cn> Reviewed-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-10-17 15:08:33 +02:00
..
blocklayout	SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()	2024-06-21 14:52:33 +02:00
filelayout	SUNRPC: Trace calls to .rpc_call_done	2024-06-21 14:53:24 +02:00
flexfilelayout	SUNRPC: Trace calls to .rpc_call_done	2024-06-21 14:53:24 +02:00
cache_lib.c
cache_lib.h
callback_proc.c	pNFS: Avoid a live lock condition in pnfs_update_layout()	2022-06-22 14:13:16 +02:00
callback_xdr.c	SUNRPC: Fix integer overflow in decode_rc_list()	2024-10-17 15:08:33 +02:00
callback.c	nfsd: stop setting ->pg_stats for unused stats	2024-09-12 11:06:45 +02:00
callback.h	NFSv4.1: Fix uninitialised variable in devicenotify	2022-02-16 12:54:18 +01:00
client.c	NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()	2024-10-17 15:08:33 +02:00
delegation.c	NFS: Avoid unnecessary rescanning of the per-server delegation list	2024-10-17 15:07:32 +02:00
delegation.h	NFSv4: Fix delegation return in cases where we have to retry	2021-07-20 16:05:47 +02:00
dir.c	SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()	2024-06-21 14:52:33 +02:00
direct.c	nfs: fix UAF in direct writes	2024-04-13 12:58:31 +02:00
dns_resolve.c	NFS: remove duplicate headers	2020-05-27 10:10:12 -04:00
dns_resolve.h
export.c	nfsd: allow reaping files still under writeback	2024-06-21 14:54:13 +02:00
file.c	nfs: don't allow reexport reclaims	2024-06-21 14:53:19 +02:00
fs_context.c	nfs: fix broken handling of the softreval mount option	2022-05-18 10:23:43 +02:00
fscache-index.c	nfs: fscache: use timespec64 in inode auxdata	2020-01-15 10:54:30 -05:00
fscache.c	NFSv4: Fix fscache cookie aux_data to ensure change_attr is included	2020-05-08 22:20:24 +01:00
fscache.h	nfs: fscache: use timespec64 in inode auxdata	2020-01-15 10:54:30 -05:00
getroot.c	NFS: Ensure security label is set for root inode	2020-03-30 19:56:50 -04:00
inode.c	nfs: Handle error of rpc_proc_register() in nfs_net_init().	2024-05-17 11:47:59 +02:00
internal.h	nfs: fix undefined behavior in nfs_block_bits()	2024-06-16 13:32:36 +02:00
io.c
iostat.h
Kconfig	nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default	2021-03-30 14:31:49 +02:00
Makefile	NFSv4.2: add client side xattr caching.	2020-07-13 17:52:46 -04:00
mount_clnt.c	NFSv3: fix rpc receive buffer size for MOUNT call	2020-05-14 18:42:44 -04:00
namespace.c	NFS: Fix an Oops in nfs_d_automount()	2023-01-14 10:15:34 +01:00
netns.h	nfs: make the rpc_stat per net namespace	2024-05-17 11:47:59 +02:00
nfs2super.c
nfs2xdr.c	NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN	2023-09-19 12:20:15 +02:00
nfs3_fs.h	NFS: Additional refactoring for fs_context conversion	2020-01-15 10:15:17 -05:00
nfs3acl.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nfs3client.c	Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING"	2022-08-21 15:15:18 +02:00
nfs3proc.c	nfs: fix acl memory leak of posix_acl_create()	2021-07-20 16:05:51 +02:00
nfs3super.c
nfs3xdr.c	NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN	2023-09-19 12:20:15 +02:00
nfs4_fs.h	NFSv4: keep state manager thread active if swap is enabled	2023-03-11 16:39:38 +01:00
nfs4client.c	nfs4: Fix kmemleak when allocate slot failed	2022-11-10 18:14:16 +01:00
nfs4file.c	NFSv4.2: Remove ifdef CONFIG_NFSD from NFSv4.2 client SSC code.	2024-06-21 14:53:08 +02:00
nfs4getroot.c
nfs4idmap.c	NFSv4: Fix races in the legacy idmapper upcall	2022-08-25 11:37:54 +02:00
nfs4idmap.h
nfs4namespace.c	NFSv4 handle port presence in fs_location server string	2022-02-16 12:54:18 +01:00
nfs4proc.c	NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS	2024-06-16 13:32:36 +02:00
nfs4renewd.c	NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals	2020-02-04 12:27:55 -05:00
nfs4session.c
nfs4session.h
nfs4state.c	NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()	2024-10-17 15:08:33 +02:00
nfs4super.c	NFS: Adjust fs_context error logging	2021-01-19 18:27:30 +01:00
nfs4sysctl.c
nfs4trace.c	pNFS/flexfiles: Add tracing for layout errors	2020-01-15 10:54:33 -05:00
nfs4trace.h	nfs4trace: fix state manager flag printing	2023-03-11 16:39:38 +01:00
nfs4xdr.c	SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()	2024-06-21 14:52:33 +02:00
nfs42.h	NFSv4.2: fix listxattr maximum XDR buffer size	2024-03-26 18:22:01 -04:00
nfs42proc.c	NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()	2024-10-17 15:08:33 +02:00
nfs42xattr.c	NFSv4.2: fix failure to unregister shrinker	2020-11-12 10:40:02 -05:00
nfs42xdr.c	SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer()	2024-06-21 14:52:33 +02:00
nfs.h
nfsroot.c	NFS: Fix an off by one in root_nfs_cat()	2024-03-26 18:22:01 -04:00
nfstrace.c
nfstrace.h	nfs: define and use the NFS_INO_INVALID_XATTR flag	2020-07-13 17:52:45 -04:00
pagelist.c	SUNRPC: Trace calls to .rpc_call_done	2024-06-21 14:53:24 +02:00
pnfs_dev.c	NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info	2023-09-19 12:20:25 +02:00
pnfs_nfs.c	NFS: nfsiod should not block forever in mempool_alloc()	2022-04-13 21:01:03 +02:00
pnfs.c	NFS: avoid infinite loop in pnfs_update_layout.	2024-09-04 13:17:38 +02:00
pnfs.h	pNFS: Avoid a live lock condition in pnfs_update_layout()	2022-06-22 14:13:16 +02:00
proc.c	NFS: Add softreval behaviour to nfs_lookup_revalidate()	2020-01-24 16:51:13 -05:00
read.c	nfs: Leave pages in the pagecache if readpage failed	2024-07-05 09:12:55 +02:00
super.c	NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations	2024-09-12 11:06:49 +02:00
symlink.c
sysctl.c
sysfs.c	NFS: rename nfs_client_kset to nfs_kset	2023-10-10 21:53:36 +02:00
sysfs.h	NFSv4: Fix up RCU annotations for struct nfs_netns_client	2020-10-15 13:31:08 -04:00
unlink.c	NFS: Avoid referencing the cred twice in async rename/unlink	2020-03-16 08:34:29 -04:00
write.c	SUNRPC: Trace calls to .rpc_call_done	2024-06-21 14:53:24 +02:00