diff mbox

Oops in nfs41_assign_slot in Linux 3.13.4

Message ID 1393442989.5090.4.camel@leira.trondhjem.org (mailing list archive)
State New, archived
Headers show

Commit Message

Trond Myklebust Feb. 26, 2014, 7:29 p.m. UTC 
Hi Ben,

On Wed, 2014-02-26 at 00:58 +0000, Ben Hutchings wrote:
> Trond, Arthur seems to be hitting a similar bug to
> <https://bugzilla.redhat.com/show_bug.cgi?id=1050206>, and it's still
> occurring in 3.13.4 even though that has the two fixes you posted there.
> The full bug report, with screenshots of the oopses, is at
> <https://bugs.debian.org/734268>.
> 

I believe I've found another corruptor of that same list. Do Arthur's
tests perhaps touch on file locking? If so, then the following patch may
help...

Cheers
  Trond

8<----------------------------------------------------------------------
From 3db0ebd8e7e67d9ee96f623e7d1dcdc35fccea7f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@primarydata.com>
Date: Wed, 26 Feb 2014 11:19:14 -0800
Subject: [PATCH] NFSv4: Fix another nfs4_sequence corruptor

nfs4_release_lockowner needs to set the rpc_message reply to point to
the nfs4_sequence_res in order to avoid another Oopsable situation
in nfs41_assign_slot.

Fixes: fbd4bfd1d9d21 (NFS: Add nfs4_sequence calls for RELEASE_LOCKOWNER)
Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
---
 fs/nfs/nfs4proc.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox

Patch

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2da6a698b8f7..d3b829f7c509 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5895,6 +5895,7 @@  static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
 	data->args.lock_owner.s_dev = server->s_dev;
 
 	msg.rpc_argp = &data->args;
+	msg.rpc_resp = &data->res;
 	rpc_call_async(server->client, &msg, 0, &nfs4_release_lockowner_ops, data);
 	return 0;
 }