You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Neil Horman e9e3d724e2 nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) ... The "bad_page()" page allocator sanity check was reported recently (call chain as follows): bad_page+0x69/0x91 free_hot_cold_page+0x81/0x144 skb_release_data+0x5f/0x98 __kfree_skb+0x11/0x1a tcp_ack+0x6a3/0x1868 tcp_rcv_established+0x7a6/0x8b9 tcp_v4_do_rcv+0x2a/0x2fa tcp_v4_rcv+0x9a2/0x9f6 do_timer+0x2df/0x52c ip_local_deliver+0x19d/0x263 ip_rcv+0x539/0x57c netif_receive_skb+0x470/0x49f :virtio_net:virtnet_poll+0x46b/0x5c5 net_rx_action+0xac/0x1b3 __do_softirq+0x89/0x133 call_softirq+0x1c/0x28 do_softirq+0x2c/0x7d do_IRQ+0xec/0xf5 default_idle+0x0/0x50 ret_from_intr+0x0/0xa default_idle+0x29/0x50 cpu_idle+0x95/0xb8 start_kernel+0x220/0x225 _sinittext+0x22f/0x236 It occurs because an skb with a fraglist was freed from the tcp retransmit queue when it was acked, but a page on that fraglist had PG_Slab set (indicating it was allocated from the Slab allocator (which means the free path above can't safely free it via put_page. We tracked this back to an nfsv4 setacl operation, in which the nfs code attempted to fill convert the passed in buffer to an array of pages in __nfs4_proc_set_acl, which gets used by the skb->frags list in xs_sendpages. __nfs4_proc_set_acl just converts each page in the buffer to a page struct via virt_to_page, but the vfs allocates the buffer via kmalloc, meaning the PG_slab bit is set. We can't create a buffer with kmalloc and free it later in the tcp ack path with put_page, so we need to either: 1) ensure that when we create the list of pages, no page struct has PG_Slab set or 2) not use a page list to send this data Given that these buffers can be multiple pages and arbitrarily sized, I think (1) is the right way to go. I've written the below patch to allocate a page from the buddy allocator directly and copy the data over to it. This ensures that we have a put_page free-able page for every entry that winds up on an skb frag list, so it can be safely freed when the frame is acked. We do a put page on each entry after the rpc_call_sync call so as to drop our own reference count to the page, leaving only the ref count taken by tcp_sendpages. This way the data will be properly freed when the ack comes in Successfully tested by myself to solve the above oops. Note, as this is the result of a setacl operation that exceeded a page of data, I think this amounts to a local DOS triggerable by an uprivlidged user, so I'm CCing security on this as well. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Trond Myklebust <Trond.Myklebust@netapp.com> CC: security@kernel.org CC: Jeff Layton <jlayton@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		14 years ago
..
Kconfig	lockd: push lock_flocks down	14 years ago
Makefile	NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure	15 years ago
cache_lib.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
cache_lib.h	NFS: Add a dns resolver for use with NFSv4 referrals and migration	16 years ago
callback.c	NFS do not find client in NFSv4 pg_authenticate	14 years ago
callback.h	NFS do not find client in NFSv4 pg_authenticate	14 years ago
callback_proc.c	NFS fix cb_sequence error processing	14 years ago
callback_xdr.c	NFS do not find client in NFSv4 pg_authenticate	14 years ago
client.c	NFS do not find client in NFSv4 pg_authenticate	14 years ago
delegation.c	NFS: Fix an NFS client lockdep issue	14 years ago
delegation.h	NFS: Move cl_delegations to the nfs_server struct	14 years ago
dir.c	NFS: Use d_automount() rather than abusing follow_link()	14 years ago
direct.c	NFS: Fix "kernel BUG at fs/aio.c:554!"	14 years ago
dns_resolve.c	sunrpc: use seconds since boot in expiry cache	15 years ago
dns_resolve.h	NFS: Use kernel DNS resolver [ver #2]	15 years ago
file.c	NFS: Fix fcntl F_GETLK not reporting some conflicts	14 years ago
fscache-index.c	NFS: Add read context retention for FS-Cache to call back with	16 years ago
fscache.c	NFS: Squelch compiler warning	15 years ago
fscache.h	NFS: Propagate 'fsc' mount option through automounts	16 years ago
getroot.c	switch nfs to ->s_d_op	14 years ago
idmap.c	nfs: fix mispelling of idmap CONFIG symbol	14 years ago
inode.c	NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount	14 years ago
internal.h	NFS do not find client in NFSv4 pg_authenticate	14 years ago
iostat.h	NFS: Squelch compiler warning in nfs_add_server_stats()	15 years ago
mount_clnt.c	NFS: Remove redundant unlikely()	14 years ago
namespace.c	Unexport do_add_mount() and add in follow_automount(), not ->d_automount()	14 years ago
nfs2xdr.c	Merge branch 'bugfixes' into nfs-for-2.6.38	14 years ago
nfs3acl.c	NFS: Prevent memory allocation failure in nfsacl_encode()	14 years ago
nfs3proc.c	NFS: readdir with vmapped pages	15 years ago
nfs3xdr.c	NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"	14 years ago
nfs4_fs.h	NFS: Move cl_state_owners and related fields to the nfs_server struct	14 years ago
nfs4filelayout.c	pnfs: add prefix to struct pnfs_layout_hdr fields	14 years ago
nfs4filelayout.h	NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure	15 years ago
nfs4filelayoutdev.c	NFS4: Avoid potential NULL pointer dereference in decode_and_add_ds().	14 years ago
nfs4namespace.c	NFSv4: Fix up the documentation for nfs_do_refmount	15 years ago
nfs4proc.c	nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3)	14 years ago
nfs4renewd.c	NFS: Move cl_delegations to the nfs_server struct	14 years ago
nfs4state.c	NFS do not find client in NFSv4 pg_authenticate	14 years ago
nfs4xdr.c	NFS: NFSv4 readdir loses entries	14 years ago
nfsroot.c	NFS: Fix a compile issue in nfs_root	14 years ago
pagelist.c	nfs: Take advantage of kmem_cache_zalloc() in nfs_page_alloc()	14 years ago
pnfs.c	NFS improve pnfs_put_deviceid_cache debug print	14 years ago
pnfs.h	pnfs: layout roc code	14 years ago
proc.c	NFS: Don't leak in nfs_proc_symlink()	14 years ago
read.c	nfs: remove extraneous and problematic calls to nfs_clear_request	14 years ago
super.c	switch nfs to ->s_d_op	14 years ago
symlink.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	15 years ago
sysctl.c	NFS: new idmapper	15 years ago
unlink.c	Merge branch 'nfs-for-2.6.38' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6	14 years ago
write.c	NFS: fix handling of malloc failure during nfs_flush_multi()	14 years ago