In case of destroying mount namespace on child reaper exit, nsproxy is zeroed to the point already. So, dereferencing of it is invalid. This patch hard-code "init_net" for all network namespace references for NFS callback services. This will be fixed with proper NFS callback containerization.
Unified · Split
| @@ -17,7 +17,6 @@ · 16 unmodified lines | |||
| 17 | #include <linux/kthread.h> | 17 | #include <linux/kthread.h> |
| 18 | #include <linux/sunrpc/svcauth_gss.h> | 18 | #include <linux/sunrpc/svcauth_gss.h> |
| 19 | #include <linux/sunrpc/bc_xprt.h> | 19 | #include <linux/sunrpc/bc_xprt.h> |
| 20 | #include <linux/nsproxy.h> | ||
| 21 | 20 | ||
| 22 | #include <net/inet_sock.h> | 21 | #include <net/inet_sock.h> |
| 23 | 22 | ||
| @@ -107,7 +106,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt) · 83 unmodified lines | |||
| 107 | { | 106 | { |
| 108 | int ret; | 107 | int ret; |
| 109 | 108 | ||
| 110 | ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET, | 109 | ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET, |
| 111 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); | 110 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); |
| 112 | if (ret <= 0) | 111 | if (ret <= 0) |
| 113 | goto out_err; | 112 | goto out_err; |
| @@ -115,7 +114,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt) · 1 unmodified line | |||
| 115 | dprintk("NFS: Callback listener port = %u (af %u)\n", | 114 | dprintk("NFS: Callback listener port = %u (af %u)\n", |
| 116 | nfs_callback_tcpport, PF_INET); | 115 | nfs_callback_tcpport, PF_INET); |
| 117 | 116 | ||
| 118 | ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET6, | 117 | ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET6, |
| 119 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); | 118 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); |
| 120 | if (ret > 0) { | 119 | if (ret > 0) { |
| 121 | nfs_callback_tcpport6 = ret; | 120 | nfs_callback_tcpport6 = ret; |
| @@ -184,7 +183,7 @@ nfs41_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt) · 62 unmodified lines | |||
| 184 | * fore channel connection. | 183 | * fore channel connection. |
| 185 | * Returns the input port (0) and sets the svc_serv bc_xprt on success | 184 | * Returns the input port (0) and sets the svc_serv bc_xprt on success |
| 186 | */ | 185 | */ |
| 187 | ret = svc_create_xprt(serv, "tcp-bc", xprt->xprt_net, PF_INET, 0, | 186 | ret = svc_create_xprt(serv, "tcp-bc", &init_net, PF_INET, 0, |
| 188 | SVC_SOCK_ANONYMOUS); | 187 | SVC_SOCK_ANONYMOUS); |
| 189 | if (ret < 0) { | 188 | if (ret < 0) { |
| 190 | rqstp = ERR_PTR(ret); | 189 | rqstp = ERR_PTR(ret); |
| @@ -254,7 +253,7 @@ int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt) · 63 unmodified lines | |||
| 254 | char svc_name[12]; | 253 | char svc_name[12]; |
| 255 | int ret = 0; | 254 | int ret = 0; |
| 256 | int minorversion_setup; | 255 | int minorversion_setup; |
| 257 | struct net *net = current->nsproxy->net_ns; | 256 | struct net *net = &init_net; |
| 258 | 257 | ||
| 259 | mutex_lock(&nfs_callback_mutex); | 258 | mutex_lock(&nfs_callback_mutex); |
| 260 | if (cb_info->users++ || cb_info->task != NULL) { | 259 | if (cb_info->users++ || cb_info->task != NULL) { |
| @@ -330,7 +329,7 @@ void nfs_callback_down(int minorversion) · 69 unmodified lines | |||
| 330 | cb_info->users--; | 329 | cb_info->users--; |
| 331 | if (cb_info->users == 0 && cb_info->task != NULL) { | 330 | if (cb_info->users == 0 && cb_info->task != NULL) { |
| 332 | kthread_stop(cb_info->task); | 331 | kthread_stop(cb_info->task); |
| 333 | svc_shutdown_net(cb_info->serv, current->nsproxy->net_ns); | 332 | svc_shutdown_net(cb_info->serv, &init_net); |
| 334 | svc_exit_thread(cb_info->rqst); | 333 | svc_exit_thread(cb_info->rqst); |
| 335 | cb_info->serv = NULL; | 334 | cb_info->serv = NULL; |
| 336 | cb_info->rqst = NULL; | 335 | cb_info->rqst = NULL; |