]>
Commit | Line | Data |
---|---|---|
a72a3eef GKH |
1 | From 3caa0c6ed754d91b15266abf222498edbef982bd Mon Sep 17 00:00:00 2001 |
2 | From: Trond Myklebust <trond.myklebust@primarydata.com> | |
3 | Date: Mon, 13 Oct 2014 10:26:43 -0400 | |
4 | Subject: NFS: Fix an uninitialised pointer Oops in the writeback error path | |
5 | ||
6 | From: Trond Myklebust <trond.myklebust@primarydata.com> | |
7 | ||
8 | commit 3caa0c6ed754d91b15266abf222498edbef982bd upstream. | |
9 | ||
10 | SteveD reports the following Oops: | |
11 | RIP: 0010:[<ffffffffa053461d>] [<ffffffffa053461d>] __put_nfs_open_context+0x1d/0x100 [nfs] | |
12 | RSP: 0018:ffff880fed687b90 EFLAGS: 00010286 | |
13 | RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000006 | |
14 | RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 | |
15 | RBP: ffff880fed687bc0 R08: 0000000000000092 R09: 000000000000047a | |
16 | R10: 0000000000000000 R11: ffff880fed6878d6 R12: ffff880fed687d20 | |
17 | R13: ffff880fed687d20 R14: 0000000000000070 R15: ffffea000aa33ec0 | |
18 | FS: 00007fce290f0740(0000) GS:ffff8807ffc60000(0000) knlGS:0000000000000000 | |
19 | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
20 | CR2: 0000000000000070 CR3: 00000007f2e79000 CR4: 00000000000007e0 | |
21 | DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
22 | DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 | |
23 | Stack: | |
24 | 0000000000000000 ffff880036c5e510 ffff880fed687d20 ffff880fed687d20 | |
25 | ffff880036c5e200 ffffea000aa33ec0 ffff880fed687bd0 ffffffffa0534710 | |
26 | ffff880fed687be8 ffffffffa053d5f0 ffff880036c5e200 ffff880fed687c08 | |
27 | Call Trace: | |
28 | [<ffffffffa0534710>] put_nfs_open_context+0x10/0x20 [nfs] | |
29 | [<ffffffffa053d5f0>] nfs_pgio_data_destroy+0x20/0x40 [nfs] | |
30 | [<ffffffffa053d672>] nfs_pgio_error+0x22/0x40 [nfs] | |
31 | [<ffffffffa053d8f4>] nfs_generic_pgio+0x74/0x2e0 [nfs] | |
32 | [<ffffffffa06b18c3>] pnfs_generic_pg_writepages+0x63/0x210 [nfsv4] | |
33 | [<ffffffffa053d579>] nfs_pageio_doio+0x19/0x50 [nfs] | |
34 | [<ffffffffa053eb84>] nfs_pageio_complete+0x24/0x30 [nfs] | |
35 | [<ffffffffa053cb25>] nfs_direct_write_schedule_iovec+0x115/0x1f0 [nfs] | |
36 | [<ffffffffa053675f>] ? nfs_get_lock_context+0x4f/0x120 [nfs] | |
37 | [<ffffffffa053d252>] nfs_file_direct_write+0x262/0x420 [nfs] | |
38 | [<ffffffffa0532d91>] nfs_file_write+0x131/0x1d0 [nfs] | |
39 | [<ffffffffa0532c60>] ? nfs_need_sync_write.isra.17+0x40/0x40 [nfs] | |
40 | [<ffffffff812127b8>] do_io_submit+0x3b8/0x840 | |
41 | [<ffffffff81212c50>] SyS_io_submit+0x10/0x20 | |
42 | [<ffffffff81610f29>] system_call_fastpath+0x16/0x1b | |
43 | ||
44 | This is due to the calls to nfs_pgio_error() in nfs_generic_pgio(), which | |
45 | happen before the nfs_pgio_header's open context is referenced in | |
46 | nfs_pgio_rpcsetup(). | |
47 | ||
48 | Reported-by: Steve Dickson <SteveD@redhat.com> | |
49 | Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> | |
50 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
51 | ||
52 | --- | |
53 | fs/nfs/pagelist.c | 3 ++- | |
54 | 1 file changed, 2 insertions(+), 1 deletion(-) | |
55 | ||
56 | --- a/fs/nfs/pagelist.c | |
57 | +++ b/fs/nfs/pagelist.c | |
58 | @@ -527,7 +527,8 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free); | |
59 | */ | |
60 | void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) | |
61 | { | |
62 | - put_nfs_open_context(hdr->args.context); | |
63 | + if (hdr->args.context) | |
64 | + put_nfs_open_context(hdr->args.context); | |
65 | if (hdr->page_array.pagevec != hdr->page_array.page_array) | |
66 | kfree(hdr->page_array.pagevec); | |
67 | } |