Subject: linux-image-2.6.26-2-xen-amd64: Kernel Oops - autofs5 nfs4 mount

From: Christian Salzmann <[email-masked]>
Date: Wed, 30 Sep 2009 11:02:53 +0200

Package: linux-image-2.6.26-2-xen-amd64
Version: 2.6.26-19
Severity: important

*** /tmp/oops
Sep 30 01:47:02 brandt kernel: [3781133.966073] BUG: unable to handle kernel paging request at ffff8800c7be5000
Sep 30 01:47:02 brandt kernel: [3781133.966082] IP: [<ffffffffa03a936b>] :nfs:nfs4_set_client+0xc3/0x17e
Sep 30 01:47:02 brandt kernel: [3781133.966107] PGD 273e067 PUD 2d42067 PMD 2d80067 PTE 0
Sep 30 01:47:02 brandt kernel: [3781133.966114] Oops: 0000 [1] SMP 
Sep 30 01:47:02 brandt kernel: [3781133.966118] CPU 0 
Sep 30 01:47:02 brandt kernel: [3781133.966121] Modules linked in: des_generic cbc crypto_blkcipher nvidia(P) rfcomm hidp l2cap bluetooth xt_physdev battery ppdev lp autofs4 rpcsec_gss_krb5 nfsd auth_rpcgss exportfs nfs lockd nfs_acl sunrpc 8021q ipv6 bridge xt_multiport nf_conntrack_ipv4 xt_state nf_conntrack xt_tcpudp ipt_LOG iptable_filter ip_tables x_tables loop snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device parport_pc parport snd rng_core i2c_i801 pcspkr psmouse i2c_core serio_raw soundcore iTCO_wdt snd_page_alloc i82975x_edac edac_core button joydev dcdbas evdev ext3 jbd mbcache dm_mirror dm_log dm_snapshot dm_mod ide_cd_mod cdrom usbhid hid ff_memless sd_mod piix ide_pci_generic ide_core ahci ata_generic floppy libata scsi_mod dock ehci_hcd uhci_hcd tg3 thermal processor fan thermal_sys [last unloaded: nvidia]
Sep 30 01:47:02 brandt kernel: [3781133.966235] Pid: 26835, comm: mount.nfs4 Tainted: P          2.6.26-2-xen-amd64 #1
Sep 30 01:47:02 brandt kernel: [3781133.966238] RIP: e030:[<ffffffffa03a936b>]  [<ffffffffa03a936b>] :nfs:nfs4_set_client+0xc3/0x17e
Sep 30 01:47:02 brandt kernel: [3781133.966258] RSP: e02b:ffff880075905ba8  EFLAGS: 00010246
Sep 30 01:47:02 brandt kernel: [3781133.966261] RAX: 0000000000000000 RBX: ffff8800dc50a800 RCX: 0000000000000004
Sep 30 01:47:02 brandt kernel: [3781133.966264] RDX: 0000000000000003 RSI: ffff8800c7be5000 RDI: ffff8800dc50aab0
Sep 30 01:47:02 brandt kernel: [3781133.966267] RBP: 0000000000000000 R08: ffffffffa038b1d0 R09: ffff880072de8400
Sep 30 01:47:02 brandt kernel: [3781133.966271] R10: 0000000000000200 R11: ffffffff80266a43 R12: ffff8800c7be4fe0
Sep 30 01:47:02 brandt kernel: [3781133.966274] R13: 0000000000000001 R14: ffff880074669400 R15: ffff8800762ace80
Sep 30 01:47:02 brandt kernel: [3781133.966280] FS:  00007f12688526e0(0000) GS:ffffffff80539000(0000) knlGS:0000000000000000
Sep 30 01:47:02 brandt kernel: [3781133.966283] CS:  e033 DS: 0000 ES: 0000
Sep 30 01:47:02 brandt kernel: [3781133.966286] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Sep 30 01:47:02 brandt kernel: [3781133.966290] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Sep 30 01:47:02 brandt kernel: [3781133.966294] Process mount.nfs4 (pid: 26835, threadinfo ffff880075904000, task ffff8800014a8f80)
Sep 30 01:47:02 brandt kernel: [3781133.966297] Stack:  ffff8800c7be46a0 ffff8800c966a8d8 0000000000000010 ffffffffa03d03a0
Sep 30 01:47:02 brandt kernel: [3781133.966304]  ffff880000000006 ffff8800c966a8d8 ffff880075905ce8 ffff880074669400
Sep 30 01:47:02 brandt kernel: [3781133.966310]  ffff8800c966a800 ffff8800762ace80 ffff8800c966a978 ffffffffa03a9c02
Sep 30 01:47:02 brandt kernel: [3781133.966316] Call Trace:
Sep 30 01:47:02 brandt kernel: [3781133.966341]  [<ffffffffa03a9c02>] :nfs:nfs4_create_server+0xb8/0x3eb
Sep 30 01:47:02 brandt kernel: [3781133.966354]  [<ffffffffa00269ff>] :tg3:tg3_start_xmit+0x35f/0x3d9
Sep 30 01:47:02 brandt kernel: [3781133.966361]  [<ffffffff8020a4ee>] __switch_to+0x3ee/0x624
Sep 30 01:47:02 brandt kernel: [3781133.966370]  [<ffffffff80269409>] get_page_from_freelist+0x405/0x507
Sep 30 01:47:02 brandt kernel: [3781133.966376]  [<ffffffff8030e050>] idr_get_empty_slot+0x15f/0x22b
Sep 30 01:47:02 brandt kernel: [3781133.966383]  [<ffffffff80287298>] cache_alloc_refill+0x59/0x550
Sep 30 01:47:02 brandt kernel: [3781133.966411]  [<ffffffffa03b2c84>] :nfs:nfs4_get_sb+0x3f4/0x594
Sep 30 01:47:02 brandt kernel: [3781133.966430]  [<ffffffff8028c2c3>] vfs_kern_mount+0x93/0x11b
Sep 30 01:47:02 brandt kernel: [3781133.966436]  [<ffffffff8028c39e>] do_kern_mount+0x43/0xdc
Sep 30 01:47:02 brandt kernel: [3781133.966442]  [<ffffffff802a2547>] do_new_mount+0x5b/0x95
Sep 30 01:47:02 brandt kernel: [3781133.966447]  [<ffffffff802a273e>] do_mount+0x1bd/0x1e7
Sep 30 01:47:02 brandt kernel: [3781133.966457]  [<ffffffff8029fdbf>] copy_mount_options+0xc9/0x126
Sep 30 01:47:02 brandt kernel: [3781133.966463]  [<ffffffff802a27f2>] sys_mount+0x8a/0xd0
Sep 30 01:47:02 brandt kernel: [3781133.966468]  [<ffffffff8020b528>] system_call+0x68/0x6d
Sep 30 01:47:02 brandt kernel: [3781133.966473]  [<ffffffff8020b4c0>] system_call+0x0/0x6d
Sep 30 01:47:02 brandt kernel: [3781133.966477] 
Sep 30 01:47:02 brandt kernel: [3781133.966479] 
Sep 30 01:47:02 brandt kernel: [3781133.966480] Code: 48 8b 74 24 68 b9 20 00 00 00 44 89 ea 48 89 c7 e8 93 f8 ff ff 85 c0 89 c5 78 53 fc 48 8d bb 90 02 00 00 b9 0c 00 00 00 4c 89 e6 <f3> a5 48 89 df e8 98 45 02 00 85 c0 89 c5 79 22 f6 05 d3 8a fe 
Sep 30 01:47:02 brandt kernel: [3781133.966513] RIP  [<ffffffffa03a936b>] :nfs:nfs4_set_client+0xc3/0x17e
Sep 30 01:47:02 brandt kernel: [3781133.966526]  RSP <ffff880075905ba8>
Sep 30 01:47:02 brandt kernel: [3781133.966528] CR2: ffff8800c7be5000
Sep 30 01:47:02 brandt kernel: [3781133.966531] ---[ end trace 96fce5bab006ac3c ]---

-- System Information:
Debian Release: 5.0.3
  APT prefers stable
  APT policy: (800, 'stable'), (500, 'proposed-updates'), (90, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-2-xen-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages linux-image-2.6.26-2-xen-amd64 depends on:
ii  initramfs-tools               0.92o      tools for generating an initramfs
ii  linux-modules-2.6.26-2-xen-am 2.6.26-19  Linux 2.6.26 modules on AMD64

linux-image-2.6.26-2-xen-amd64 recommends no packages.

Versions of packages linux-image-2.6.26-2-xen-amd64 suggests:
ii  grub                       0.97-47lenny2 GRand Unified Bootloader (Legacy v
pn  linux-doc-2.6.26           <none>        (no description available)

-- no debconf information

---

From: Uwe Kleine-König <[email-masked]>
Date: Wed, 30 Sep 2009 14:15:02 +0200

Hello,

> Sep 30 01:47:02 brandt kernel: [3781133.966235] Pid: 26835, comm: mount.nfs4 Tainted: P          2.6.26-2-xen-amd64 #1
Can you please reproduce that without ever loading the nvidia module?

Best regards
Uwe

-- 
Pengutronix e.K.                              | Uwe Kleine-König            |
Industrial Linux Solutions                    | http://www.pengutronix.de/  |

---

From: Christian Salzmann <[email-masked]>
Date: Tue, 06 Oct 2009 15:19:18 +0200

Hello,

> Can you please reproduce that without ever loading the nvidia module?

it took me some time to reproduce the oops, apologies. Please find the syslog excerpt in the attachment.
Thank you in advance.

ciao
Christian
Oct  3 06:44:09 brandt syslogd 1.5.0#5: restart.
Oct  3 06:44:09 brandt snort[22759]: Preprocessor/Decoder Rule Count: 0 
Oct  3 06:44:09 brandt snort[22759]: Snort initialization completed successfully (pid=22759) 
Oct  3 06:44:09 brandt snort[22759]: Not Using PCAP_FRAMES 
Oct  3 12:12:33 brandt kernel: [146921.292801] BUG: unable to handle kernel paging request at ffff8800b86db000
Oct  3 12:12:33 brandt kernel: [146921.292810] IP: [<ffffffffa03ab36c>] :nfs:nfs4_set_client+0xc3/0x17e
Oct  3 12:12:33 brandt kernel: [146921.292834] PGD 2744067 PUD 2b47067 PMD 2d0b067 PTE 0
Oct  3 12:12:33 brandt kernel: [146921.292841] Oops: 0000 [1] SMP 
Oct  3 12:12:33 brandt kernel: [146921.292845] CPU 0 
Oct  3 12:12:33 brandt kernel: [146921.292848] Modules linked in: rfcomm hidp l2cap bluetooth xt_physdev battery ppdev lp autofs4 rpcsec_gss_krb5 nfsd auth_rpcgss exportfs nfs lockd nfs_acl sunrpc 8021q ipv6 bridge xt_multiport nf_conntrack_ipv4 xt_state nf_conntrack xt_tcpudp ipt_LOG iptable_filter ip_tables x_tables loop snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss i2c_i801 parport_pc parport psmouse i2c_core snd_seq_midi snd_rawmidi snd_seq_midi_event pcspkr serio_raw snd_seq rng_core snd_timer snd_seq_device snd soundcore snd_page_alloc i82975x_edac edac_core button joydev evdev dcdbas ext3 jbd mbcache dm_mirror dm_log dm_snapshot dm_mod ide_cd_mod cdrom usbhid hid ff_memless sd_mod piix ide_pci_generic ide_core floppy ahci ata_generic libata scsi_mod dock ehci_hcd tg3 uhci_hcd thermal processor fan thermal_sys [last unloaded: scsi_wait_scan]
Oct  3 12:12:33 brandt kernel: [146921.292957] Pid: 31330, comm: mount.nfs4 Not tainted 2.6.26-2-xen-amd64 #1
Oct  3 12:12:33 brandt kernel: [146921.292961] RIP: e030:[<ffffffffa03ab36c>]  [<ffffffffa03ab36c>] :nfs:nfs4_set_client+0xc3/0x17e
Oct  3 12:12:33 brandt kernel: [146921.292979] RSP: e02b:ffff88007f543ba8  EFLAGS: 00010246
Oct  3 12:12:33 brandt kernel: [146921.292982] RAX: 0000000000000000 RBX: ffff88008bff5000 RCX: 0000000000000004
Oct  3 12:12:33 brandt kernel: [146921.292986] RDX: 0000000000000003 RSI: ffff8800b86db000 RDI: ffff88008bff52b0
Oct  3 12:12:33 brandt kernel: [146921.292989] RBP: 0000000000000000 R08: ffffffffa038d230 R09: ffff88008f449000
Oct  3 12:12:33 brandt kernel: [146921.292993] R10: 0000000000000200 R11: ffffffff80266a7b R12: ffff8800b86dafe0
Oct  3 12:12:33 brandt kernel: [146921.292996] R13: 0000000000000001 R14: ffff8800ed2e4800 R15: ffff8800edd56280
Oct  3 12:12:33 brandt kernel: [146921.293003] FS:  00007fc1e00056e0(0000) GS:ffffffff8053a000(0000) knlGS:0000000000000000
Oct  3 12:12:33 brandt kernel: [146921.293006] CS:  e033 DS: 0000 ES: 0000
Oct  3 12:12:33 brandt kernel: [146921.293010] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Oct  3 12:12:33 brandt kernel: [146921.293014] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Oct  3 12:12:33 brandt kernel: [146921.293018] Process mount.nfs4 (pid: 31330, threadinfo ffff88007f542000, task ffff880089468780)
Oct  3 12:12:33 brandt kernel: [146921.293021] Stack:  ffff8800b86daa60 ffff8800ec953ad8 0000000000000010 ffffffffa03d24a0
Oct  3 12:12:33 brandt kernel: [146921.293029]  ffff880000000006 ffff8800ec953ad8 ffff88007f543ce8 ffff8800ed2e4800
Oct  3 12:12:33 brandt kernel: [146921.293035]  ffff8800ec953a00 ffff8800edd56280 ffff8800ec953b78 ffffffffa03abc03
Oct  3 12:12:33 brandt kernel: [146921.293040] Call Trace:
Oct  3 12:12:33 brandt kernel: [146921.293064]  [<ffffffffa03abc03>] :nfs:nfs4_create_server+0xb8/0x3eb
Oct  3 12:12:33 brandt kernel: [146921.293077]  [<ffffffffa0030a11>] :tg3:tg3_start_xmit+0x35f/0x3d9
Oct  3 12:12:33 brandt kernel: [146921.293085]  [<ffffffff8020a4ee>] __switch_to+0x3ee/0x624
Oct  3 12:12:33 brandt kernel: [146921.293092]  [<ffffffff80269446>] get_page_from_freelist+0x40f/0x51c
Oct  3 12:12:33 brandt kernel: [146921.293099]  [<ffffffff8030e3fd>] idr_get_empty_slot+0x15c/0x228
Oct  3 12:12:33 brandt kernel: [146921.293106]  [<ffffffff80287342>] cache_alloc_refill+0x59/0x5a4
Oct  3 12:12:33 brandt kernel: [146921.293138]  [<ffffffffa03b4d54>] :nfs:nfs4_get_sb+0x3f4/0x598
Oct  3 12:12:33 brandt kernel: [146921.293146]  [<ffffffff8028c3cb>] vfs_kern_mount+0x93/0x11b
Oct  3 12:12:33 brandt kernel: [146921.293152]  [<ffffffff8028c4a6>] do_kern_mount+0x43/0xe3
Oct  3 12:12:33 brandt kernel: [146921.293158]  [<ffffffff802a2681>] do_new_mount+0x5b/0x95
Oct  3 12:12:33 brandt kernel: [146921.293163]  [<ffffffff802a2878>] do_mount+0x1bd/0x1e7
Oct  3 12:12:33 brandt kernel: [146921.293172]  [<ffffffff8029fef3>] copy_mount_options+0xc9/0x126
Oct  3 12:12:33 brandt kernel: [146921.293178]  [<ffffffff802a292c>] sys_mount+0x8a/0xce
Oct  3 12:12:33 brandt kernel: [146921.293184]  [<ffffffff8020b528>] system_call+0x68/0x6d
Oct  3 12:12:33 brandt kernel: [146921.293188]  [<ffffffff8020b4c0>] system_call+0x0/0x6d
Oct  3 12:12:33 brandt kernel: [146921.293193] 
Oct  3 12:12:33 brandt kernel: [146921.293194] 
Oct  3 12:12:33 brandt kernel: [146921.293195] Code: 48 8b 74 24 68 b9 20 00 00 00 44 89 ea 48 89 c7 e8 92 f8 ff ff 85 c0 89 c5 78 53 fc 48 8d bb 90 02 00 00 b9 0c 00 00 00 4c 89 e6 <f3> a5 48 89 df e8 a0 46 02 00 85 c0 89 c5 79 22 f6 05 52 8b fe 
Oct  3 12:12:33 brandt kernel: [146921.293228] RIP  [<ffffffffa03ab36c>] :nfs:nfs4_set_client+0xc3/0x17e
Oct  3 12:12:33 brandt kernel: [146921.293240]  RSP <ffff88007f543ba8>
Oct  3 12:12:33 brandt kernel: [146921.293242] CR2: ffff8800b86db000
Oct  3 12:12:33 brandt kernel: [146921.293246] ---[ end trace 07e1aa343c1d96cb ]---

---

From: Ben Hutchings <[email-masked]>
Date: Tue, 6 Oct 2009 18:37:23 +0100

> it took me some time to reproduce the oops, apologies. Please find the syslog excerpt in the attachment.

I tracked this bug down and a fix should be in the next stable update.
Although the fix is "obvious" to me looking at the code, it would be better
if you could verify the fix on your system.  Are you happy to build and
install a new kernel package, given instructions?

Ben.

-- 
Ben Hutchings
To err is human; to really foul things up requires a computer.

---

From: Christian Salzmann <[email-masked]>
Date: Tue, 06 Oct 2009 21:37:43 +0200

Hi Ben,
> I tracked this bug down and a fix should be in the next stable update.
Wow, thank you for your immediate response!
> install a new kernel package, given instructions?
This wouldn't be the first one, so any patch is welcome ;-)

ciao
Christian

---

From: Ben Hutchings <[email-masked]>
Date: Tue, 06 Oct 2009 22:56:48 +0100

> This wouldn't be the first one, so any patch is welcome ;-)

The patch is attached.

Instructions for rebuilding the kernel package are at
<http://kernel-handbook.alioth.debian.org/ch-common-tasks.html#s-common-official>.
Make sure that APT downloads the source from stable-security, not from
unstable.

Ben.

-- 
Ben Hutchings
To err is human; to really foul things up requires a computer.
From: Ben Hutchings <[email-masked]>
Date: Sun, 04 Oct 2009 14:25:50 +0100
Subject: [PATCH] nfs: Avoid overrun when copying client IP address string

As seen in <http://bugs.debian.org/549002>, nfs4_init_client() can
overrun the source string when copying the client IP address from
nfs_parsed_mount_data::client_address to nfs_client::cl_ipaddr.  Since
these are both treated as null-terminated strings elsewhere, the copy
should be done with strlcpy() not memcpy().

Signed-off-by: Ben Hutchings <[email-masked]>
---
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 75c9cd2..f525a2f 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1073,7 +1073,7 @@ static int nfs4_init_client(struct nfs_client *clp,
 				      1, flags & NFS_MOUNT_NORESVPORT);
 	if (error < 0)
 		goto error;
-	memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+	strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 
 	error = nfs_idmap_new(clp);
 	if (error < 0) {