Sasha Levin b2ea70afad nfsd: Fix oops when parsing a 0 length export ... expkey_parse() oopses when handling a 0 length export. This is easily triggerable from usermode by writing 0 bytes into '/proc/[proc id]/net/rpc/nfsd.fh/channel'. Below is the log: [ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff [ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160 [ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 1402.287632] CPU 1 [ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6 [ 1402.287632] RIP: 0010:[<ffffffff812b4b99>] [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292 [ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400 [ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0 [ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000 [ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000 [ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0 [ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000 [ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0 [ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0) [ 1402.287632] Stack: [ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e [ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0 [ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63 [ 1402.287632] Call Trace: [ 1402.287632] [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc [ 1402.287632] [<ffffffff81111f63>] ? might_fault+0x97/0x9e [ 1402.287632] [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e [ 1402.287632] [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f [ 1402.287632] [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130 [ 1402.287632] [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a [ 1402.287632] [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b [ 1402.287632] [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad [ 1402.287632] [<ffffffff8113fe81>] vfs_write+0xaa/0xfd [ 1402.287632] [<ffffffff8114142d>] ? fget_light+0x35/0x9e [ 1402.287632] [<ffffffff8113ff8b>] sys_write+0x48/0x6f [ 1402.287632] [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b [ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff [ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85 [ 1402.287632] RIP [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1 [ 1402.287632] RSP <ffff880077f0fd68> [ 1402.287632] CR2: ffff880077c49fff [ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]--- Cc: "J. Bruce Fields" <bfields@fieldses.org> Cc: Neil Brown <neilb@suse.de> Cc: linux-nfs@vger.kernel.org Cc: stable@kernel.org Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>		2011-12-06 16:18:37 -05:00
..
9p	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
adfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
affs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
afs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
autofs4	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
befs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
bfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2011-11-06 20:03:41 -08:00
cachefiles
ceph	ceph/super.c: quiet sparse noise	2011-11-05 21:10:12 -07:00
cifs	Merge git://git.samba.org/sfrench/cifs-2.6	2011-11-07 09:56:22 -08:00
coda	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
configfs
cramfs
debugfs
devpts	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
dlm
ecryptfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
efs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
exofs	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
exportfs
ext2	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	2011-11-02 11:41:01 -07:00
ext3	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	2011-11-02 11:41:01 -07:00
ext4	Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux	2011-11-06 19:02:23 -08:00
fat	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
freevxfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
fscache
fuse	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
gfs2	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
hfs	Merge branch 'akpm' (Andrew's incoming - part two)	2011-11-02 16:07:27 -07:00
hfsplus	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
hostfs	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	2011-11-02 11:41:01 -07:00
hpfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
hppfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
hugetlbfs	filesystems: add missing nlink wrappers	2011-11-02 12:53:43 +01:00
isofs	Merge branch 'akpm' (Andrew's incoming - part two)	2011-11-02 16:07:27 -07:00
jbd	jbd/jbd2: validate sb->s_first in journal_get_superblock()	2011-11-01 19:04:59 -04:00
jbd2	jbd2: Unify log messages in jbd2 code	2011-11-01 19:09:18 -04:00
jffs2	Merge git://git.infradead.org/mtd-2.6	2011-11-07 09:11:16 -08:00
jfs	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
lockd
logfs	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
minix	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
ncpfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
nfs	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
nfs_common
nfsd	nfsd: Fix oops when parsing a 0 length export	2011-12-06 16:18:37 -05:00
nilfs2	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
nls
notify
ntfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
ocfs2	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
omfs
openpromfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
partitions	treewide: use __printf not __attribute__((format(printf,...)))	2011-10-31 17:30:54 -07:00
proc	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
pstore
qnx4	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
quota	Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux	2011-11-06 19:02:23 -08:00
ramfs	ramfs: remove module leftovers	2011-11-02 16:06:58 -07:00
reiserfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
romfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
squashfs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next	2011-11-04 16:48:37 -07:00
sysfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
sysv	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
ubifs	Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6	2011-11-07 08:52:19 -08:00
udf	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	2011-11-02 11:41:01 -07:00
ufs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
xfs	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
aio.c	aio: allocate kiocbs in batches	2011-11-02 16:07:03 -07:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	binfmt_elf: fix PIE execution with randomization disabled	2011-11-02 16:06:58 -07:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	filesystems: add missing nlink wrappers	2011-11-02 12:53:43 +01:00
binfmt_script.c
binfmt_som.c
bio-integrity.c	fs: add export.h to files using EXPORT_SYMBOL/THIS_MODULE macros	2011-10-31 19:30:31 -04:00
bio.c	block: Remove the control of complete cpu from bio.	2011-10-24 16:11:30 +02:00
block_dev.c	Merge branch 'for-3.2/drivers' of git://git.kernel.dk/linux-block	2011-11-04 17:22:14 -07:00
buffer.c	Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux	2011-11-06 19:02:23 -08:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c	Cross Memory Attach	2011-10-31 17:30:44 -07:00
dcache.c	vfs: d_invalidate() should leave mountpoints alone	2011-11-07 10:54:10 -08:00
dcookies.c
direct-io.c	direct-io: merge direct_io_walker into __blockdev_direct_IO	2011-10-28 14:58:58 +02:00
drop_caches.c
eventfd.c
eventpoll.c	epoll: fix spurious lockdep warnings	2011-10-31 17:30:57 -07:00
exec.c	oom: remove oom_disable_count	2011-10-31 17:30:45 -07:00
fcntl.c
fhandle.c
fifo.c
file_table.c
file.c
filesystems.c
fs_struct.c
fs-writeback.c	writeback: Add a 'reason' to wb_writeback_work	2011-10-31 00:33:36 +08:00
generic_acl.c
inode.c	vfs: protect i_nlink	2011-11-02 12:53:43 +01:00
internal.h
ioctl.c
ioprio.c	fs: add export.h to files using EXPORT_SYMBOL/THIS_MODULE macros	2011-10-31 19:30:31 -04:00
Kconfig	tmpfs: add "tmpfs" to the Kconfig prompt to make it obvious.	2011-10-31 17:30:45 -07:00
Kconfig.binfmt
libfs.c	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
locks.c	Merge branch 'for-3.2' of git://linux-nfs.org/~bfields/linux	2011-10-25 15:42:01 +02:00
Makefile	fs/Makefile: Stupid typo breakage of exofs inclusion	2011-10-27 08:36:51 +02:00
mbcache.c
mpage.c
namei.c	VFS: we need to set LOOKUP_JUMPED on mountpoint crossing	2011-11-07 14:58:06 -08:00
namespace.c	vfs: add "device" tag to /proc/self/mountstats	2011-10-28 13:55:08 +02:00
no-block.c
open.c	leases: fix write-open/read-lease race	2011-10-28 14:59:00 +02:00
pipe.c	fs/pipe.c: add ->statfs callback for pipefs	2011-10-31 17:30:51 -07:00
pnode.c
pnode.h
posix_acl.c	vfs: pass all mask flags check_acl and posix_acl_permission	2011-10-28 14:58:54 +02:00
read_write.c	Cross Memory Attach	2011-10-31 17:30:44 -07:00
read_write.h
readdir.c
select.c
seq_file.c
signalfd.c
splice.c
stack.c	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
stat.c	readlinkat: ensure we return ENOENT for the empty pathname for normal lookups	2011-11-02 12:53:42 +01:00
statfs.c	VFS: fix statfs() automounter semantics regression	2011-11-04 18:15:59 -07:00
super.c	vfs: ignore error on forced remount	2011-11-02 12:53:42 +01:00
sync.c	writeback: Add a 'reason' to wb_writeback_work	2011-10-31 00:33:36 +08:00
timerfd.c
utimes.c
xattr_acl.c
xattr.c