Reproducable DoS with NFS+XFS under 2.6.{5,8.1}

[Justin Piszcz]

Two issues.

1 - With 2.6.5
2 - With 2.6.8.1

1 - I have the actual oops.
2 - Reproducable every time I do it but I'd have to copy the panic off the
    screen which isn't entirely there.


Problem 1: If you try to copy a file off of an NFS share while it is being 
written:

------------[ cut here ]------------
kernel BUG at fs/xfs/support/debug.c:106!
invalid operand: 0000 [#1]
PREEMPT
CPU:    0
EIP:    0060:[<c02751a4>]    Not tainted
EFLAGS: 00010246   (2.6.5)
EIP is at cmn_err+0xa4/0xc0
eax: 00000000   ebx: ee5a4000   ecx: c0536d24   edx: c0473e98
esi: c042a9c9   edi: c054bb9e   ebp: 00000000   esp: ee5a5a30
ds: 007b   es: 007b   ss: 0068
Process nfsd (pid: 263, threadinfo=ee5a4000 task=ee5dc6c0)
Stack: c043f961 c042cc0b c054bb60 00000293 ee5a4000 04f93a8f 00000000
e31d1a60
       c02418f7 00000000 c0437320 ee39b8e0 ee39b360 04f93a8f ee5a4000
00000000
       ef3fd51c efa42a00 c0274c02 ef4b4698 00000000 00000000 e31d1a60
ee39b37c
Call Trace:
 [<c02418f7>] xfs_iget_core+0x4a7/0x590
 [<c0274c02>] vn_initialize+0x92/0xb0
 [<c0241afa>] xfs_iget+0x11a/0x150
 [<c0261533>] xfs_vget+0x63/0x100
 [<c02744b3>] vfs_vget+0x43/0x50
 [<c0273e11>] linvfs_get_dentry+0x51/0x90
 [<c01b1f5d>] find_exported_dentry+0x3d/0x700
 [<c02e4885>] e1000_alloc_rx_buffers+0x65/0x110
 [<c02e44b5>] e1000_clean_rx_irq+0x105/0x470
 [<c02e4187>] e1000_clean+0x97/0xc0
 [<c0342df4>] net_rx_action+0x74/0x100
 [<c033dd77>] alloc_skb+0x47/0xf0
 [<c033d3d7>] sock_alloc_send_pskb+0xc7/0x1d0
 [<c033d50d>] sock_alloc_send_skb+0x2d/0x40
 [<c03b2001>] do_bindings+0x91/0x2e0
 [<c0342759>] dev_queue_xmit+0x209/0x2a0
 [<c0375194>] ip_finish_output2+0xa4/0x1b0
 [<c03750f0>] ip_finish_output2+0x0/0x1b0
 [<c034cf73>] nf_hook_slow+0xf3/0x140
 [<c01ba74a>] exp_find_key+0x8a/0xa0
 [<c01b29cd>] export_decode_fh+0x5d/0x7a
 [<c01b4c70>] nfsd_acceptable+0x0/0x120
 [<c01b4f70>] fh_verify+0x1e0/0x5a0
 [<c01b4c70>] nfsd_acceptable+0x0/0x120
 [<c0116faf>] scheduler_tick+0x1f/0x520
 [<c01b67f9>] nfsd_open+0x39/0x150
 [<c01b6f7d>] nfsd_write+0x5d/0x360
 [<c010971b>] do_IRQ+0xfb/0x130
 [<c013b190>] cache_flusharray+0x50/0x100
 [<c033df74>] kfree_skbmem+0x24/0x30
 [<c033dff7>] __kfree_skb+0x77/0x100
 [<c03ff104>] svcauth_unix_accept+0x274/0x2c0
 [<c01be608>] nfsd3_proc_write+0xb8/0x120
 [<c01b30d8>] nfsd_dispatch+0xd8/0x1e0
 [<c01b3000>] nfsd_dispatch+0x0/0x1e0
 [<c03fb2f8>] svc_process+0x4b8/0x620
 [<c01b2e46>] nfsd+0x206/0x3c0
 [<c01b2c40>] nfsd+0x0/0x3c0
 [<c0104f0d>] kernel_thread_helper+0x5/0x18

Code: 0f 0b 6a 00 2b cc 42 c0 83 c4 10 5b 5e 5f 5d c3 e8 c7 28 ea
 <6>note: nfsd[263] exited with preempt_count 1

And then NFS stops working.

Problem 2:

I can re-produce this every time I try it.

% removepkg kde* x11*
% cd /nfs/slackware-10.0/slackware
% installpkg k/*tgz x11*tgz

It gets to the following package:
Installing package kdebase-3.2.3-i486-1 ([required])...
Then PANICS the 2.6.8.1 kernel!!!

If I ftp the packages over, it is fine, no problems at all.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/