Oops Null pointer dereference 2.3.99-pre5 NFS Root

From: Ben Von Handorf (handorf@penguinpowered.com)
Date: Sat Apr 22 2000 - 11:34:14 EST


OK, this is my first attempt at anything really kernel related, so feel free
to flame away.

2.3.99-pre5, configured for NFS Root, mounts the / directory (according to
logs on the other machine) then Oopses with a NULL pointer dereference.

ksymoops tells me it's in xdr_decode_fhstatus. I can't figure out how this code
could work (printks are mine):

in fs/nfs/mount_clnt.c, line 120:

static int
xdr_decode_fhstatus(struct rpc_rqst *req, u32 *p, struct mnt_fhstatus *res)
{
        printk( "res==%lx, res->fh=%lx\n", res, res->fh ) ;
        memset((u8 *)res, 0, sizeof(*res));
        printk( "res==%lx, res->fh=%lx\n", res, res->fh ) ;
        if ((res->status = ntohl(*p++)) == 0) {
                printk( "p==%lx, ntohl(*p++)=%x\n", p, ntohl(*(p-1)) ) ;
fails---> res->fh->size = NFS2_FHSIZE;
                memcpy(res->fh->data, p, NFS2_FHSIZE);
        }
        return 0;
}

By definition, isn't res->fh going to always be NULL? I certianly don't
understand NFS enough to make a more detailed investigation, but I'm fairly
confident on this point (just call me an idiot).

It also looks like the next function, xdr_decode_fhstatus3, may also suffer
from the same issue, be it my misunderstanding or an actual problem.

If anyone can give some insight into what should happen here, I'll
gladly put effort into it.

Find ksymoops output attached.

Humbly yours,

Ben Von Handorf
handorf@penguinpowered.com



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sun Apr 23 2000 - 21:00:21 EST