• Bill.Baker@oracle.com's avatar
    nfs: system crashes after NFS4ERR_MOVED recovery · ad86f605
    Bill.Baker@oracle.com authored
    nfs4_update_server unconditionally releases the nfs_client for the
    source server. If migration fails, this can cause the source server's
    nfs_client struct to be left with a low reference count, resulting in
    use-after-free.  Also, adjust reference count handling for ELOOP.
    
    NFS: state manager: migration failed on NFSv4 server nfsvmu10 with error 6
    WARNING: CPU: 16 PID: 17960 at fs/nfs/client.c:281 nfs_put_client+0xfa/0x110 [nfs]()
    	nfs_put_client+0xfa/0x110 [nfs]
    	nfs4_run_state_manager+0x30/0x40 [nfsv4]
    	kthread+0xd8/0xf0
    
    BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8
    	nfs4_xdr_enc_write+0x6b/0x160 [nfsv4]
    	rpcauth_wrap_req+0xac/0xf0 [sunrpc]
    	call_transmit+0x18c/0x2c0 [sunrpc]
    	__rpc_execute+0xa6/0x490 [sunrpc]
    	rpc_async_schedule+0x15/0x20 [sunrpc]
    	process_one_work+0x160/0x470
    	worker_thread+0x112/0x540
    	? rescuer_thread+0x3f0/0x3f0
    	kthread+0xd8/0xf0
    
    This bug was introduced by 32e62b7c ("NFS: Add nfs4_update_server"),
    but the fix applies cleanly to 52442f9b ("NFS4: Avoid migration loops")
    Reported-by: default avatarHelen Chao <helen.chao@oracle.com>
    Fixes: 52442f9b ("NFS4: Avoid migration loops")
    Signed-off-by: default avatarBill Baker <bill.baker@oracle.com>
    Reviewed-by: default avatarChuck Lever <chuck.lever@oracle.com>
    Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
    ad86f605
nfs4client.c 31.9 KB