| Message ID | 20200615071211.31326-1-lxgrxd@163.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | nfsd: fix kernel crash when load nfsd in docker | expand |
On Mon, Jun 15, 2020 at 03:12:11PM +0800, Luo Xiaogang wrote: > We load nfsd module in the docker container, kernel crash as following. > > The 'current->nsproxy->net_ns->gen->ptr[nfsd_net_id]' is overflow in the > nfsd_init_net. > > We should use the net_ns which is being init in the nfsd_init_net, > not the 'current->nsproxy->net_ns'. Thanks! Actually, I think my problem was that net init and exit are just the wrong place to be doing this--I moved them to nfsd start/stop instead. And then that exposed the fact that I had an inode leak. Do the following two patches help? --b. From 16f954bd5c481596a63271a91963bf260e2f3f46 Mon Sep 17 00:00:00 2001 From: "J. Bruce Fields" <bfields@redhat.com> Date: Tue, 23 Jun 2020 16:00:33 -0400 Subject: [PATCH 1/2] nfsd4: fix nfsdfs reference count loop We don't drop the reference on the nfsdfs filesystem with mntput(nn->nfsd_mnt) until nfsd_exit_net(), but that won't be called until the nfsd module's unloaded, and we can't unload the module as long as there's a reference on nfsdfs. So this prevents module unloading. Signed-off-by: J. Bruce Fields <bfields@redhat.com> --- fs/nfsd/nfs4state.c | 8 +++++++- fs/nfsd/nfsctl.c | 22 ++++++++++++---------- fs/nfsd/nfsd.h | 3 +++ 3 files changed, 22 insertions(+), 11 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index bb3d2c32664a..cce2510b2cca 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -7912,9 +7912,14 @@ nfs4_state_start_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); int ret; - ret = nfs4_state_create_net(net); + ret = get_nfsdfs(net); if (ret) return ret; + ret = nfs4_state_create_net(net); + if (ret) { + mntput(nn->nfsd_mnt); + return ret; + } locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) @@ -7984,6 +7989,7 @@ nfs4_state_shutdown_net(struct net *net) nfsd4_client_tracking_exit(net); nfs4_state_destroy_net(net); + mntput(nn->nfsd_mnt); } void diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index b68e96681522..cf98a81ca1ea 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1424,6 +1424,18 @@ static struct file_system_type nfsd_fs_type = { }; MODULE_ALIAS_FS("nfsd"); +int get_nfsdfs(struct net *net) +{ + struct nfsd_net *nn = net_generic(net, nfsd_net_id); + struct vfsmount *mnt; + + mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); + if (IS_ERR(mnt)) + return PTR_ERR(mnt); + nn->nfsd_mnt = mnt; + return 0; +} + #ifdef CONFIG_PROC_FS static int create_proc_exports_entry(void) { @@ -1451,7 +1463,6 @@ unsigned int nfsd_net_id; static __net_init int nfsd_init_net(struct net *net) { int retval; - struct vfsmount *mnt; struct nfsd_net *nn = net_generic(net, nfsd_net_id); retval = nfsd_export_init(net); @@ -1478,16 +1489,8 @@ static __net_init int nfsd_init_net(struct net *net) init_waitqueue_head(&nn->ntf_wq); seqlock_init(&nn->boot_lock); - mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); - if (IS_ERR(mnt)) { - retval = PTR_ERR(mnt); - goto out_mount_err; - } - nn->nfsd_mnt = mnt; return 0; -out_mount_err: - nfsd_reply_cache_shutdown(nn); out_drc_error: nfsd_idmap_shutdown(net); out_idmap_error: @@ -1500,7 +1503,6 @@ static __net_exit void nfsd_exit_net(struct net *net) { struct nfsd_net *nn = net_generic(net, nfsd_net_id); - mntput(nn->nfsd_mnt); nfsd_reply_cache_shutdown(nn); nfsd_idmap_shutdown(net); nfsd_export_shutdown(net); diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h index 36cdd81b6688..57c832d1b30f 100644 --- a/fs/nfsd/nfsd.h +++ b/fs/nfsd/nfsd.h @@ -90,6 +90,8 @@ void nfsd_destroy(struct net *net); bool i_am_nfsd(void); +int get_nfsdfs(struct net *); + struct nfsdfs_client { struct kref cl_ref; void (*cl_release)(struct kref *kref); @@ -100,6 +102,7 @@ struct dentry *nfsd_client_mkdir(struct nfsd_net *nn, struct nfsdfs_client *ncl, u32 id, const struct tree_descr *); void nfsd_client_rmdir(struct dentry *dentry); + #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) #ifdef CONFIG_NFSD_V2_ACL extern const struct svc_version nfsd_acl_version2;
Thanks for reply. Very well, the two patches you provided solved this problem.
At 2020-06-24 09:29:01, "J. Bruce Fields" <bfields@fieldses.org> wrote: >On Mon, Jun 15, 2020 at 03:12:11PM +0800, Luo Xiaogang wrote: >> We load nfsd module in the docker container, kernel crash as following. >> >> The 'current->nsproxy->net_ns->gen->ptr[nfsd_net_id]' is overflow in the >> nfsd_init_net. >> >> We should use the net_ns which is being init in the nfsd_init_net, >> not the 'current->nsproxy->net_ns'. > >Thanks! Actually, I think my problem was that net init and exit are >just the wrong place to be doing this--I moved them to nfsd start/stop >instead. > >And then that exposed the fact that I had an inode leak. > >Do the following two patches help? Just test it on Ubuntu 18.04 + Docker 19.03.6, and the docker image is ubuntu:18.04. Your patchset helps, here is my reported-and-tested-by, Thanks very much. Reported-and-Tested-by: Luo Xiaogang <lxgrxd@163.com> >--b. > >From 16f954bd5c481596a63271a91963bf260e2f3f46 Mon Sep 17 00:00:00 2001 >From: "J. Bruce Fields" <bfields@redhat.com> >Date: Tue, 23 Jun 2020 16:00:33 -0400 >Subject: [PATCH 1/2] nfsd4: fix nfsdfs reference count loop > >We don't drop the reference on the nfsdfs filesystem with >mntput(nn->nfsd_mnt) until nfsd_exit_net(), but that won't be called >until the nfsd module's unloaded, and we can't unload the module as long >as there's a reference on nfsdfs. So this prevents module unloading. > >Signed-off-by: J. Bruce Fields <bfields@redhat.com> >--- > fs/nfsd/nfs4state.c | 8 +++++++- > fs/nfsd/nfsctl.c | 22 ++++++++++++---------- > fs/nfsd/nfsd.h | 3 +++ > 3 files changed, 22 insertions(+), 11 deletions(-) > >diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c >index bb3d2c32664a..cce2510b2cca 100644 >--- a/fs/nfsd/nfs4state.c >+++ b/fs/nfsd/nfs4state.c >@@ -7912,9 +7912,14 @@ nfs4_state_start_net(struct net *net) > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > int ret; > >- ret = nfs4_state_create_net(net); >+ ret = get_nfsdfs(net); > if (ret) > return ret; >+ ret = nfs4_state_create_net(net); >+ if (ret) { >+ mntput(nn->nfsd_mnt); >+ return ret; >+ } > locks_start_grace(net, &nn->nfsd4_manager); > nfsd4_client_tracking_init(net); > if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) >@@ -7984,6 +7989,7 @@ nfs4_state_shutdown_net(struct net *net) > > nfsd4_client_tracking_exit(net); > nfs4_state_destroy_net(net); >+ mntput(nn->nfsd_mnt); > } > > void >diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c >index b68e96681522..cf98a81ca1ea 100644 >--- a/fs/nfsd/nfsctl.c >+++ b/fs/nfsd/nfsctl.c >@@ -1424,6 +1424,18 @@ static struct file_system_type nfsd_fs_type = { > }; > MODULE_ALIAS_FS("nfsd"); > >+int get_nfsdfs(struct net *net) >+{ >+ struct nfsd_net *nn = net_generic(net, nfsd_net_id); >+ struct vfsmount *mnt; >+ >+ mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); >+ if (IS_ERR(mnt)) >+ return PTR_ERR(mnt); >+ nn->nfsd_mnt = mnt; >+ return 0; >+} >+ > #ifdef CONFIG_PROC_FS > static int create_proc_exports_entry(void) > { >@@ -1451,7 +1463,6 @@ unsigned int nfsd_net_id; > static __net_init int nfsd_init_net(struct net *net) > { > int retval; >- struct vfsmount *mnt; > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > retval = nfsd_export_init(net); >@@ -1478,16 +1489,8 @@ static __net_init int nfsd_init_net(struct net *net) > init_waitqueue_head(&nn->ntf_wq); > seqlock_init(&nn->boot_lock); > >- mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); >- if (IS_ERR(mnt)) { >- retval = PTR_ERR(mnt); >- goto out_mount_err; >- } >- nn->nfsd_mnt = mnt; > return 0; > >-out_mount_err: >- nfsd_reply_cache_shutdown(nn); > out_drc_error: > nfsd_idmap_shutdown(net); > out_idmap_error: >@@ -1500,7 +1503,6 @@ static __net_exit void nfsd_exit_net(struct net *net) > { > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > >- mntput(nn->nfsd_mnt); > nfsd_reply_cache_shutdown(nn); > nfsd_idmap_shutdown(net); > nfsd_export_shutdown(net); >diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h >index 36cdd81b6688..57c832d1b30f 100644 >--- a/fs/nfsd/nfsd.h >+++ b/fs/nfsd/nfsd.h >@@ -90,6 +90,8 @@ void nfsd_destroy(struct net *net); > > bool i_am_nfsd(void); > >+int get_nfsdfs(struct net *); >+ > struct nfsdfs_client { > struct kref cl_ref; > void (*cl_release)(struct kref *kref); >@@ -100,6 +102,7 @@ struct dentry *nfsd_client_mkdir(struct nfsd_net *nn, > struct nfsdfs_client *ncl, u32 id, const struct tree_descr *); > void nfsd_client_rmdir(struct dentry *dentry); > >+ > #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) > #ifdef CONFIG_NFSD_V2_ACL > extern const struct svc_version nfsd_acl_version2; >-- >2.26.2 > > >From 51de3b460b39e862f7dcfd4d600e8de0afe73e29 Mon Sep 17 00:00:00 2001 >From: "J. Bruce Fields" <bfields@redhat.com> >Date: Tue, 23 Jun 2020 21:01:19 -0400 >Subject: [PATCH 2/2] nfsd: fix nfsdfs inode reference count leak > >I don't understand this code well, but I'm seeing a warning about a >still-referenced inode on unmount, and every other similar filesystem >does a dput() here. > >Signed-off-by: J. Bruce Fields <bfields@redhat.com> >--- > fs/nfsd/nfsctl.c | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c >index cf98a81ca1ea..cd05732f8eaa 100644 >--- a/fs/nfsd/nfsctl.c >+++ b/fs/nfsd/nfsctl.c >@@ -1335,6 +1335,7 @@ void nfsd_client_rmdir(struct dentry *dentry) > WARN_ON_ONCE(ret); > fsnotify_rmdir(dir, dentry); > d_delete(dentry); >+ dput(dentry); > inode_unlock(dir); > } > >-- >2.26.2
On Fri, Jun 26, 2020 at 08:45:23PM +0800, Luo Xiaogang wrote: > At 2020-06-24 09:29:01, "J. Bruce Fields" <bfields@fieldses.org> wrote: > >On Mon, Jun 15, 2020 at 03:12:11PM +0800, Luo Xiaogang wrote: > >> We load nfsd module in the docker container, kernel crash as following. > >> > >> The 'current->nsproxy->net_ns->gen->ptr[nfsd_net_id]' is overflow in the > >> nfsd_init_net. > >> > >> We should use the net_ns which is being init in the nfsd_init_net, > >> not the 'current->nsproxy->net_ns'. > > > >Thanks! Actually, I think my problem was that net init and exit are > >just the wrong place to be doing this--I moved them to nfsd start/stop > >instead. > > > >And then that exposed the fact that I had an inode leak. > > > >Do the following two patches help? > > Just test it on Ubuntu 18.04 + Docker 19.03.6, and the docker image is ubuntu:18.04. > > Your patchset helps, here is my reported-and-tested-by, Thanks very much. > > Reported-and-Tested-by: Luo Xiaogang <lxgrxd@163.com> Thank you! --b. > > > >--b. > > > >From 16f954bd5c481596a63271a91963bf260e2f3f46 Mon Sep 17 00:00:00 2001 > >From: "J. Bruce Fields" <bfields@redhat.com> > >Date: Tue, 23 Jun 2020 16:00:33 -0400 > >Subject: [PATCH 1/2] nfsd4: fix nfsdfs reference count loop > > > >We don't drop the reference on the nfsdfs filesystem with > >mntput(nn->nfsd_mnt) until nfsd_exit_net(), but that won't be called > >until the nfsd module's unloaded, and we can't unload the module as long > >as there's a reference on nfsdfs. So this prevents module unloading. > > > >Signed-off-by: J. Bruce Fields <bfields@redhat.com> > >--- > > fs/nfsd/nfs4state.c | 8 +++++++- > > fs/nfsd/nfsctl.c | 22 ++++++++++++---------- > > fs/nfsd/nfsd.h | 3 +++ > > 3 files changed, 22 insertions(+), 11 deletions(-) > > > >diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c > >index bb3d2c32664a..cce2510b2cca 100644 > >--- a/fs/nfsd/nfs4state.c > >+++ b/fs/nfsd/nfs4state.c > >@@ -7912,9 +7912,14 @@ nfs4_state_start_net(struct net *net) > > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > int ret; > > > >- ret = nfs4_state_create_net(net); > >+ ret = get_nfsdfs(net); > > if (ret) > > return ret; > >+ ret = nfs4_state_create_net(net); > >+ if (ret) { > >+ mntput(nn->nfsd_mnt); > >+ return ret; > >+ } > > locks_start_grace(net, &nn->nfsd4_manager); > > nfsd4_client_tracking_init(net); > > if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) > >@@ -7984,6 +7989,7 @@ nfs4_state_shutdown_net(struct net *net) > > > > nfsd4_client_tracking_exit(net); > > nfs4_state_destroy_net(net); > >+ mntput(nn->nfsd_mnt); > > } > > > > void > >diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > >index b68e96681522..cf98a81ca1ea 100644 > >--- a/fs/nfsd/nfsctl.c > >+++ b/fs/nfsd/nfsctl.c > >@@ -1424,6 +1424,18 @@ static struct file_system_type nfsd_fs_type = { > > }; > > MODULE_ALIAS_FS("nfsd"); > > > >+int get_nfsdfs(struct net *net) > >+{ > >+ struct nfsd_net *nn = net_generic(net, nfsd_net_id); > >+ struct vfsmount *mnt; > >+ > >+ mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); > >+ if (IS_ERR(mnt)) > >+ return PTR_ERR(mnt); > >+ nn->nfsd_mnt = mnt; > >+ return 0; > >+} > >+ > > #ifdef CONFIG_PROC_FS > > static int create_proc_exports_entry(void) > > { > >@@ -1451,7 +1463,6 @@ unsigned int nfsd_net_id; > > static __net_init int nfsd_init_net(struct net *net) > > { > > int retval; > >- struct vfsmount *mnt; > > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > > > retval = nfsd_export_init(net); > >@@ -1478,16 +1489,8 @@ static __net_init int nfsd_init_net(struct net *net) > > init_waitqueue_head(&nn->ntf_wq); > > seqlock_init(&nn->boot_lock); > > > >- mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); > >- if (IS_ERR(mnt)) { > >- retval = PTR_ERR(mnt); > >- goto out_mount_err; > >- } > >- nn->nfsd_mnt = mnt; > > return 0; > > > >-out_mount_err: > >- nfsd_reply_cache_shutdown(nn); > > out_drc_error: > > nfsd_idmap_shutdown(net); > > out_idmap_error: > >@@ -1500,7 +1503,6 @@ static __net_exit void nfsd_exit_net(struct net *net) > > { > > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > > >- mntput(nn->nfsd_mnt); > > nfsd_reply_cache_shutdown(nn); > > nfsd_idmap_shutdown(net); > > nfsd_export_shutdown(net); > >diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h > >index 36cdd81b6688..57c832d1b30f 100644 > >--- a/fs/nfsd/nfsd.h > >+++ b/fs/nfsd/nfsd.h > >@@ -90,6 +90,8 @@ void nfsd_destroy(struct net *net); > > > > bool i_am_nfsd(void); > > > >+int get_nfsdfs(struct net *); > >+ > > struct nfsdfs_client { > > struct kref cl_ref; > > void (*cl_release)(struct kref *kref); > >@@ -100,6 +102,7 @@ struct dentry *nfsd_client_mkdir(struct nfsd_net *nn, > > struct nfsdfs_client *ncl, u32 id, const struct tree_descr *); > > void nfsd_client_rmdir(struct dentry *dentry); > > > >+ > > #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) > > #ifdef CONFIG_NFSD_V2_ACL > > extern const struct svc_version nfsd_acl_version2; > >-- > >2.26.2 > > > > > >From 51de3b460b39e862f7dcfd4d600e8de0afe73e29 Mon Sep 17 00:00:00 2001 > >From: "J. Bruce Fields" <bfields@redhat.com> > >Date: Tue, 23 Jun 2020 21:01:19 -0400 > >Subject: [PATCH 2/2] nfsd: fix nfsdfs inode reference count leak > > > >I don't understand this code well, but I'm seeing a warning about a > >still-referenced inode on unmount, and every other similar filesystem > >does a dput() here. > > > >Signed-off-by: J. Bruce Fields <bfields@redhat.com> > >--- > > fs/nfsd/nfsctl.c | 1 + > > 1 file changed, 1 insertion(+) > > > >diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > >index cf98a81ca1ea..cd05732f8eaa 100644 > >--- a/fs/nfsd/nfsctl.c > >+++ b/fs/nfsd/nfsctl.c > >@@ -1335,6 +1335,7 @@ void nfsd_client_rmdir(struct dentry *dentry) > > WARN_ON_ONCE(ret); > > fsnotify_rmdir(dir, dentry); > > d_delete(dentry); > >+ dput(dentry); > > inode_unlock(dir); > > } > > > >-- > >2.26.2
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index b68e96681522..87bb348a05ed 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1340,8 +1340,7 @@ void nfsd_client_rmdir(struct dentry *dentry) static int nfsd_fill_super(struct super_block *sb, struct fs_context *fc) { - struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, - nfsd_net_id); + struct nfsd_net *nn = net_generic(fc->net_ns, nfsd_net_id); struct dentry *dentry; int ret; @@ -1395,15 +1394,25 @@ static void nfsd_fs_free_fc(struct fs_context *fc) put_net(fc->s_fs_info); } +static int nfsd_fs_parse_monolithic(struct fs_context *fc, void *data) +{ + put_net(fc->net_ns); + fc->net_ns = get_net(data); + + put_user_ns(fc->user_ns); + fc->user_ns = get_user_ns(fc->net_ns->user_ns); + + return 0; +} + static const struct fs_context_operations nfsd_fs_context_ops = { .free = nfsd_fs_free_fc, .get_tree = nfsd_fs_get_tree, + .parse_monolithic = nfsd_fs_parse_monolithic, }; static int nfsd_init_fs_context(struct fs_context *fc) { - put_user_ns(fc->user_ns); - fc->user_ns = get_user_ns(fc->net_ns->user_ns); fc->ops = &nfsd_fs_context_ops; return 0; } @@ -1478,7 +1487,7 @@ static __net_init int nfsd_init_net(struct net *net) init_waitqueue_head(&nn->ntf_wq); seqlock_init(&nn->boot_lock); - mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL); + mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", net); if (IS_ERR(mnt)) { retval = PTR_ERR(mnt); goto out_mount_err;
We load nfsd module in the docker container, kernel crash as following. The 'current->nsproxy->net_ns->gen->ptr[nfsd_net_id]' is overflow in the nfsd_init_net. We should use the net_ns which is being init in the nfsd_init_net, not the 'current->nsproxy->net_ns'. [ 939.174448] Installing knfsd (copyright (C) 1996 okir@monad.swb.de). [ 939.174533] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 939.174536] #PF: supervisor write access in kernel mode [ 939.174538] #PF: error_code(0x0002) - not-present page [ 939.174540] PGD 0 P4D 0 [ 939.174543] Oops: 0002 [#1] SMP PTI [ 939.174546] CPU: 0 PID: 5031 Comm: modprobe Tainted: G O 5.3.0-51-generic #44~18.04.2-Ubuntu [ 939.174548] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 939.174562] RIP: 0010:nfsd_fill_super+0x71/0x90 [nfsd] [ 939.174565] Code: 85 c0 89 c3 74 09 89 d8 5b 41 5c 41 5d 5d c3 49 8b 7c 24 68 31 f6 48 c7 c2 70 24 9f c0 e8 97 fe ff ff 48 3d 00 f0 ff ff 77 0d <49> 89 45 58 89 d8 5b 41 5c 41 5d 5d c3 89 c3 eb cb 0f 1f 40 00 66 [ 939.174567] RSP: 0018:ffffaf12850f7aa8 EFLAGS: 00010287 [ 939.174569] RAX: ffff94269f29a600 RBX: 0000000000000000 RCX: 0000000000000002 [ 939.174570] RDX: 0000000000000000 RSI: 0000000000000100 RDI: ffff94269f30f820 [ 939.174572] RBP: ffffaf12850f7ac0 R08: ffff94269f29a620 R09: 0000000000000000 [ 939.174573] R10: 0000000000000000 R11: fefefefefefefeff R12: ffff942754da4800 [ 939.174575] R13: 0000000000000000 R14: ffffffffc09b94d0 R15: ffff94275b344480 [ 939.174577] FS: 00007f25508ed540(0000) GS:ffff94275ba00000(0000) knlGS:0000000000000000 [ 939.174579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 939.174580] CR2: 0000000000000058 CR3: 00000000619be000 CR4: 00000000000406f0 [ 939.174586] Call Trace: [ 939.174593] vfs_get_super+0x5b/0xe0 [ 939.174597] ? vfs_parse_fs_param+0xdc/0x1c0 [ 939.174608] nfsd_fs_get_tree+0x2c/0x30 [nfsd] [ 939.174610] vfs_get_tree+0x2a/0x100 [ 939.174613] fc_mount+0x12/0x40 [ 939.174615] vfs_kern_mount.part.31+0x76/0x90 [ 939.174618] vfs_kern_mount+0x13/0x20 [ 939.174627] nfsd_init_net+0x101/0x140 [nfsd] [ 939.174630] ops_init+0x44/0x120 [ 939.174633] register_pernet_operations+0xed/0x200 [ 939.174645] ? trace_event_define_fields_nfsd_stateid_class+0xb3/0xb3 [nfsd] [ 939.174647] register_pernet_subsys+0x28/0x40 [ 939.174658] init_nfsd+0x22/0xcbc [nfsd] [ 939.174661] do_one_initcall+0x4a/0x1fa [ 939.174664] ? _cond_resched+0x19/0x40 [ 939.174667] ? kmem_cache_alloc_trace+0x15c/0x210 [ 939.174671] do_init_module+0x5f/0x227 [ 939.174674] load_module+0x1aa4/0x2140 [ 939.174678] __do_sys_finit_module+0xfc/0x120 [ 939.174681] ? __do_sys_finit_module+0xfc/0x120 [ 939.174684] __x64_sys_finit_module+0x1a/0x20 [ 939.174687] do_syscall_64+0x5a/0x130 [ 939.174690] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 939.174692] RIP: 0033:0x7f2550a3270d [ 939.174694] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 53 f7 0c 00 f7 d8 64 89 01 48 [ 939.174696] RSP: 002b:00007ffd4a3d9738 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 939.174698] RAX: ffffffffffffffda RBX: 000055d5164584e0 RCX: 00007f2550a3270d [ 939.174699] RDX: 0000000000000000 RSI: 000055d5146b7358 RDI: 0000000000000007 [ 939.174701] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 [ 939.174702] R10: 0000000000000007 R11: 0000000000000246 R12: 000055d5146b7358 [ 939.174704] R13: 0000000000000000 R14: 000055d5164547c0 R15: 000055d5164584e0 [ 939.174706] Modules linked in: nfsd(+) auth_rpcgss nfs_acl lockd grace veth xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo xt_addrtype iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bpfilter br_netfilter bridge stp llc nls_utf8 isofs vboxsf(O) aufs overlay intel_rapl_msr snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device snd_timer snd joydev soundcore vboxvideo intel_rapl_common drm_vram_helper ttm drm_kms_helper drm fb_sys_fops crct10dif_pclmul crc32_pclmul syscopyarea sysfillrect ghash_clmulni_intel sysimgblt aesni_intel aes_x86_64 crypto_simd cryptd glue_helper vboxguest(O) intel_rapl_perf input_leds mac_hid serio_raw binfmt_misc sch_fq_codel cuse sunrpc parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid psmouse ahci libahci e1000 i2c_piix4 pata_acpi video [ 939.174739] CR2: 0000000000000058 [ 939.174742] ---[ end trace 9fba6033f11f2b84 ]--- [ 939.174752] RIP: 0010:nfsd_fill_super+0x71/0x90 [nfsd] [ 939.174754] Code: 85 c0 89 c3 74 09 89 d8 5b 41 5c 41 5d 5d c3 49 8b 7c 24 68 31 f6 48 c7 c2 70 24 9f c0 e8 97 fe ff ff 48 3d 00 f0 ff ff 77 0d <49> 89 45 58 89 d8 5b 41 5c 41 5d 5d c3 89 c3 eb cb 0f 1f 40 00 66 [ 939.174755] RSP: 0018:ffffaf12850f7aa8 EFLAGS: 00010287 [ 939.174757] RAX: ffff94269f29a600 RBX: 0000000000000000 RCX: 0000000000000002 [ 939.174759] RDX: 0000000000000000 RSI: 0000000000000100 RDI: ffff94269f30f820 [ 939.174760] RBP: ffffaf12850f7ac0 R08: ffff94269f29a620 R09: 0000000000000000 [ 939.174761] R10: 0000000000000000 R11: fefefefefefefeff R12: ffff942754da4800 [ 939.174763] R13: 0000000000000000 R14: ffffffffc09b94d0 R15: ffff94275b344480 [ 939.174765] FS: 00007f25508ed540(0000) GS:ffff94275ba00000(0000) knlGS:0000000000000000 [ 939.174766] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 939.174768] CR2: 0000000000000058 CR3: 00000000619be000 CR4: 00000000000406f0 Signed-off-by: Luo Xiaogang <lxgrxd@163.com> --- fs/nfsd/nfsctl.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)