NFSv4, RDMA : panic on __skb_free_datagram_locked
Issue
- system panics with the following stack :
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8ae6743e6104
PGD 7db801067 P4D 7db801067 PUD 2f47de2063 PMD 80000019342001e3
Oops: 0011 [#1] SMP NOPTI
CPU: 64 PID: 1734451 Comm: nfsd Kdump: loaded Not tainted 4.18.0-193.14.3.el8_2.x86_64 #1
RIP: 0010:0xffff8ae6743e6104
Code: 00 00 31 16 17 5d 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 14 83 <00> 00 00 09 00 00 00 02 00 00 00 18 00 30 00 00 00 10 01 1a 00 b0
RSP: 0018:ffffafc4a3713e40 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8afcc21f0980 RCX: 0000000000000018
RDX: ffff8ae6743e6104 RSI: ffff8ae626f51000 RDI: ffff8ae626f51000
RBP: ffff8ae626f51000 R08: ffff8afd1f72a678 R09: ffff8afcc21f0fc4
R10: ffff8afcc21f0a48 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8aee75280e00 R15: ffff8aee75280e00
FS: 0000000000000000(0000) GS:ffff8afd1f700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8ae6743e6104 CR3: 00000007da80a005 CR4: 00000000007606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
? __skb_free_datagram_locked+0x53/0x120
? svc_xprt_release+0x1d/0x140 [sunrpc]
? svc_recv+0x965/0x970 [sunrpc]
? nfsd_destroy+0x50/0x50 [nfsd]
? nfsd_destroy+0x50/0x50 [nfsd]
? nfsd+0xd1/0x140 [nfsd]
? kthread+0x112/0x130
? kthread_flush_work_fn+0x10/0x10
? ret_from_fork+0x1f/0x40
Environment
- NFS over RDMA
- Seen on RHEL8.2 and RHEL 7.9
- Clients mounting shares using both TCP and RDMA transports
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.