Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 253190 - NULL pointer deref in nfs_create
NULL pointer deref in nfs_create
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
x86_64 Linux
low Severity low
: ---
: ---
Assigned To: Peter Zijlstra
Martin Jenner
Depends On:
  Show dependency treegraph
Reported: 2007-08-17 08:04 EDT by Peter Zijlstra
Modified: 2014-08-11 01:40 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-06-20 09:32:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
serial console output (18.21 KB, text/plain)
2007-08-17 08:04 EDT, Peter Zijlstra
no flags Details
patch required for recent assembler (4.32 KB, patch)
2007-08-17 08:06 EDT, Peter Zijlstra
no flags Details | Diff
second patch needed to compile on recent userspace (1.23 KB, patch)
2007-08-17 08:06 EDT, Peter Zijlstra
no flags Details | Diff

  None (edit)
Description Peter Zijlstra 2007-08-17 08:04:27 EDT
Description of problem:

Unable to handle kernel NULL pointer dereference at 0000000000000350 RIP:

Version-Release number of selected component (if applicable):

cvsdist as of 17/08/2007 - head 1.98
build with patches provided below on a rawhide userspace as of a month or so ago

How reproducible:

every time

Steps to Reproduce:
1. install rawhide
2. get rhel4 source
3. apply patches below
4. make CC=/usr/bin/gcc34
5. make CC=/usr/bin/gcc34 modules_install install
6. ensure /etc/fstab includes an NFS mount
7. reboot
8. watch fireworks

Actual results:

Unable to handle kernel NULL pointer dereference at 0000000000000350 RIP:

Expected results:

successfull mount, mount error at worst.

Additional info:

full trace:
Unable to handle kernel NULL pointer dereference at 0000000000000350 RIP:
PML4 76c7b067 PGD 0
Oops: 0000 [1]
Modules linked in: nfs(U) lockd(U) nfs_acl(U) rfcomm(U) l2cap(U) bluetooth(U)
sunrpc(U) tg3(U) md5(U) ipv6(U) cpufreq_ondemand(U) dm_mirr
or(U) dm_mod(U) button(U) battery(U) ac(U) parport_pc(U) lp(U) parport(U)
loop(U) ahci(U) libata(U) sd_mod(U) scsi_mod(U) ext3(U) jbd(U)
ehci_hcd(U) ohci_hcd(U) uhci_hcd(U)
Pid: 1281, comm: mount.nfs Not tainted 2.6.9-prep
RIP: 0010:[<ffffffffa01e6c5f>] <ffffffffa01e6c5f>{:nfs:nfs_create+303}
RSP: 0018:0000010076c23dd8  EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000001007fe01240 RCX: 0000000000000000
RDX: 0000010076c23dd8 RSI: 00000100776d67f0 RDI: 000001007fe01240
RBP: 0000000000000000 R08: 000001007fe01240 R09: 0000000000000000
R10: ffffffff801ff6d8 R11: ffffffffa01e6b30 R12: 00000100776d67f0
R13: 0000000076c23ef8 R14: 0000000000000000 R15: 0000007fbfffff0b
FS:  0000002a95ac16f0(0000) GS:ffffffff80553a00(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000350 CR3: 0000000000101000 CR4: 00000000000006e0
Process mount.nfs (pid: 1281, threadinfo 0000010076c22000, task 00000100778fe2b0)
Stack: 00003ef800000001 00000100024f2000 0000000000000000 0000000000000246
       000001007fe01240 0000000000000246 00000100024f2000 0000010076c23e58
       0000000000000000 ffffffff8019b3c0
Call Trace:<ffffffff8019b3c0>{vfs_getattr64+34} <ffffffff8019b5a4>{vfs_lstat64+44}
       <ffffffff8019b8cc>{sys_newlstat+17} <ffffffff80110a8e>{system_call+126}

Code: 48 8b 80 50 03 00 00 48 8b 40 18 ff 50 68 48 89 df 89 c5 e8
RIP <ffffffffa01e6c5f>{:nfs:nfs_create+303} RSP <0000010076c23dd8>
CR2: 0000000000000350
 <0>Kernel panic - not syncing: Oops
 <7>eth0: no IPv6 routers present
Comment 1 Peter Zijlstra 2007-08-17 08:04:27 EDT
Created attachment 161728 [details]
serial console output
Comment 2 Peter Zijlstra 2007-08-17 08:06:01 EDT
Created attachment 161729 [details]
patch required for recent assembler

first patch to allow compilation on recent userspace
Comment 3 Peter Zijlstra 2007-08-17 08:06:56 EDT
Created attachment 161730 [details]
second patch needed to compile on recent userspace
Comment 4 Peter Zijlstra 2007-08-17 08:09:53 EDT
compiled the kernel with nfs build in, gives:

Unable to handle kernel NULL pointer dereference at 0000000000000350 RIP:

[root@taijtu linux-2.6.9]# addr2line -e vmlinux ffffffff801f343f

which is line 31 below:

  1 /*
  2  * Following a failed create operation, we drop the dentry rather
  3  * than retain a negative dentry. This avoids a problem in the event
  4  * that the operation succeeded on the server, but an error in the
  5  * reply path made it appear to have failed.
  6  */
  7 static int nfs_create(struct inode *dir, struct dentry *dentry, int mode,
  8                 struct nameidata *nd)
  9 {
 10         struct iattr attr;
 11         int error;
 12         int open_flags = 0;
 14         dfprintk(VFS, "NFS: create(%s/%ld, %s\n", dir->i_sb->s_id,
 15                 dir->i_ino, dentry->d_name.name);
 17         attr.ia_mode = mode;
 18         attr.ia_valid = ATTR_MODE;
 20         if (nd && (nd->flags & LOOKUP_CREATE))
 21                 open_flags = nd->intent.open.flags;
 23         /*
 24          * The 0 argument passed into the create function should one day
 25          * contain the O_EXCL flag if requested. This allows NFSv3 to
 26          * select the appropriate create strategy. Currently open_namei
 27          * does not pass the create flags.
 28          */
 29         lock_kernel();
 30         nfs_begin_data_update(dir);
 31         error = NFS_PROTO(dir)->create(dir, dentry, &attr, open_flags);
 32         nfs_end_data_update(dir);
 33         if (error != 0)
 34                 goto out_err;
 35         nfs_renew_times(dentry);
 36         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
 37         unlock_kernel();
 38         return 0;
 40 out_err:
 41         unlock_kernel();
 42         d_drop(dentry);
 43         return error;
 44 }
Comment 6 Jeff Layton 2007-08-21 10:28:43 EDT
Strange -- it's not clear to me why mount.nfs would be attempting to stat a file
on a NFS filesystem. Once the mount syscall is done, I don't think it tries to
do any access on the fs...

Did this client have heirarchical mounts (nfs mount within a nfs mount)? If so,
that might explain it (since mount.nfs would try to stat the mountpoint).

So I guess you're using nfs-utils from rawhide too? If so, what version is it?
There's an upstream transition to make nfs use string-based mount options.
Perhaps that got enabled for this kernel somehow and it actually allowed the
mount to work?
Comment 7 Jiri Pallich 2012-06-20 09:32:43 EDT
Thank you for submitting this issue for consideration in Red Hat Enterprise Linux. The release for which you requested us to review is now End of Life. 
Please See https://access.redhat.com/support/policy/updates/errata/

If you would like Red Hat to re-consider your feature request for an active release, please re-open the request via appropriate support channels and provide additional supporting details about the importance of this issue.

Note You need to log in before you can comment on or make changes to this bug.