linux-kernel - NFSd: NULL-dereference when writing to v4_end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 25 Nov 2018 09:17:10 +0300
From:   Anatoly Trosinenko <anatoly.trosinenko@...il.com>
To:     "J. Bruce Fields" <bfields@...ldses.org>,
        Jeff Layton <jlayton@...nel.org>
Cc:     linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: NFSd: NULL-dereference when writing to v4_end_grace when server is
 not yet started

Hello,

When manually exploring the kernel NFSd feature, I have stumbled upon
a NULL-dereference when writing to v4_end_grace when server is not yet
started.

How to reproduce with kvm-xfstests:

1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
3) From `kvm-xfstests shell`:

root@...-xfstests:~# mount none /proc/fs/nfsd -t nfsd
root@...-xfstests:~# echo Y > /proc/fs/nfsd/v4_end_grace
[   11.986359] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000000
[   11.987187] PGD 800000007af97067 P4D 800000007af97067 PUD 78e9d067 PMD 0
[   11.987774] Oops: 0000 [#1] SMP PTI
[   11.988087] CPU: 0 PID: 281 Comm: bash Not tainted
4.20.0-rc3-xfstests-00306-ge195ca6cb6f #1
[   11.988808] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.1-1ubuntu1 04/01/2014
[   11.989575] RIP: 0010:__list_del_entry_valid+0x25/0x90
[   11.990019] Code: c3 0f 1f 40 00 48 b9 00 01 00 00 00 00 ad de 48
8b 07 48 8b 57 08 48 39 c8 74 26 48 b9 00 02 00 00 00 00 ad de 48 39
ca 74 2e <48> 8b 32 48 39 fe 75 3a 48 8b 50 08 48 39 f2 75 48 b8 01 00
00 00
[   11.991610] RSP: 0018:ffffa7d8c088fde8 EFLAGS: 00010207
[   11.992066] RAX: 0000000000000000 RBX: ffff9ac7bc10ec28 RCX: dead000000000200
[   11.992678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ac7bc10ec28
[   11.993291] RBP: ffffa7d8c088fe20 R08: 0000000000000000 R09: 0000000000000001
[   11.993902] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002
[   11.994583] R13: ffff9ac7bd8a9e00 R14: ffff9ac7ba56d008 R15: 0000000000000000
[   11.995226] FS:  0000000000000000(0000) GS:ffff9ac7bfc00000(0063)
knlGS:00000000f7d76700
[   11.996018] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   11.996514] CR2: 0000000000000000 CR3: 0000000078c94005 CR4: 0000000000360ef0
[   11.997126] Call Trace:
[   11.997346]  locks_end_grace+0x1d/0x50
[   11.997675]  write_v4_end_grace+0xe7/0x1b0
[   11.998033]  ? nfsctl_transaction_write+0x80/0x80
[   11.998440]  nfsctl_transaction_write+0x45/0x80
[   11.998835]  __vfs_write+0x36/0x1a0
[   11.999141]  ? rcu_read_lock_sched_held+0x6c/0x80
[   11.999550]  ? rcu_sync_lockdep_assert+0x2e/0x60
[   11.999955]  ? __sb_start_write+0x147/0x1b0
[   12.000320]  ? vfs_write+0x161/0x1a0
[   12.000634]  vfs_write+0xba/0x1a0
[   12.000927]  ksys_write+0x52/0xc0
[   12.001220]  do_fast_syscall_32+0x97/0x2d0
[   12.001578]  entry_SYSENTER_compat+0x81/0x93
[   12.001951] CR2: 0000000000000000
[   12.002243] ---[ end trace 4137b5fb8d67f6b5 ]---
[   12.002645] RIP: 0010:__list_del_entry_valid+0x25/0x90
[   12.003089] Code: c3 0f 1f 40 00 48 b9 00 01 00 00 00 00 ad de 48
8b 07 48 8b 57 08 48 39 c8 74 26 48 b9 00 02 00 00 00 00 ad de 48 39
ca 74 2e <48> 8b 32 48 39 fe 75 3a 48 8b 50 08 48 39 f2 75 48 b8 01 00
00 00
[   12.004682] RSP: 0018:ffffa7d8c088fde8 EFLAGS: 00010207
[   12.005133] RAX: 0000000000000000 RBX: ffff9ac7bc10ec28 RCX: dead000000000200
[   12.005746] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ac7bc10ec28
[   12.006360] RBP: ffffa7d8c088fe20 R08: 0000000000000000 R09: 0000000000000001
[   12.006974] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002
[   12.007587] R13: ffff9ac7bd8a9e00 R14: ffff9ac7ba56d008 R15: 0000000000000000
[   12.008206] FS:  0000000000000000(0000) GS:ffff9ac7bfc00000(0063)
knlGS:00000000f7d76700
[   12.008898] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   12.009394] CR2: 0000000000000000 CR3: 0000000078c94005 CR4: 0000000000360ef0
[   12.010004] BUG: sleeping function called from invalid context at
include/linux/percpu-rwsem.h:34
[   12.010765] in_atomic(): 1, irqs_disabled(): 1, pid: 281, name: bash
[   12.011311] INFO: lockdep is turned off.
[   12.011652] irq event stamp: 19366
[   12.012025] hardirqs last  enabled at (19365): [<ffffffff89189da6>]
get_page_from_freelist+0x2c6/0x1660
[   12.012862] hardirqs last disabled at (19366): [<ffffffff890015f4>]
trace_hardirqs_off_thunk+0x1a/0x1c
[   12.013658] softirqs last  enabled at (18228): [<ffffffff89c0032f>]
__do_softirq+0x32f/0x440
[   12.014413] softirqs last disabled at (18221): [<ffffffff8908c806>]
irq_exit+0xa6/0xe0
[   12.015091] CPU: 0 PID: 281 Comm: bash Tainted: G      D
4.20.0-rc3-xfstests-00306-ge195ca6cb6f #1
[   12.015934] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.1-1ubuntu1 04/01/2014
[   12.016751] Call Trace:
[   12.017056]  dump_stack+0x67/0x90
[   12.017348]  ___might_sleep.cold.14+0x9f/0xaf
[   12.017728]  exit_signals+0x1c/0x200
[   12.018041]  do_exit+0xac/0xb00
[   12.018319]  ? ksys_write+0x52/0xc0
[   12.018626]  rewind_stack_do_exit+0x17/0x20
[   12.019006] note: bash[281] exited with preempt_count 1

Best regards
Anatoly