Hello,

The rpcb_getport_async function in the sunrpc module copies larger
memory area than the allocated on Ubuntu Hardy.
Because of this problem, NFS users might encounter oops. See Bug #224750.

This bug is derived from Linux 2.6.24 in kernel.org.
It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
86d61d8638ddf9cdf87df26c7fa69b2804425fbe.

I don't know how important it is for Ubuntu users, but I made the
patch to solve it, which is the attachment.

Regards,

--
HIRANO Takahito
hiranotaka@zng.info
--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

HIRANO Takahito wrote:
> Hello,
>
> The rpcb_getport_async function in the sunrpc module copies larger
> memory area than the allocated on Ubuntu Hardy.
> Because of this problem, NFS users might encounter oops. See Bug #224750.
>
> This bug is derived from Linux 2.6.24 in kernel.org.
> It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
> 86d61d8638ddf9cdf87df26c7fa69b2804425fbe.
>
> I don't know how important it is for Ubuntu users, but I made the
> patch to solve it, which is the attachment.
>
> Regards,
>
>

Have you sent this to stable@kernel.org? Stable 2.6.24.y could benefit
from this patch.

rtg
--
Tim Gardner tim.gardner@ubuntu.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

HIRANO Takahito wrote:
> Hello,
>
> The rpcb_getport_async function in the sunrpc module copies larger
> memory area than the allocated on Ubuntu Hardy.
> Because of this problem, NFS users might encounter oops. See Bug #224750.
>
> This bug is derived from Linux 2.6.24 in kernel.org.
> It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
> 86d61d8638ddf9cdf87df26c7fa69b2804425fbe.
>
> I don't know how important it is for Ubuntu users, but I made the
> patch to solve it, which is the attachment.
>
> Regards,
>
>

ACK - please test the linux_2.6.24-17.31ubuntu2 kernel at
http://ppa.launchpad.net/timg-tpi/ubuntu. Note you'll have to enable
-proposed in order to get the -17 LUM/LBM and meta packages.

rtg
--
Tim Gardner tim.gardner@ubuntu.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

I lost some mails from Tim (maybe my MTA sucks...), so I'm replying to myself.

I sent the patch to stable@kernel.org,
but I don't think it will be accepted because the maintenance of
2.6.24.y has finished.

Thanks,
HIRANO Takahito

2008/5/2 HIRANO Takahito <hiranotaka@zng.info>:
> Hello,
>
> The rpcb_getport_async function in the sunrpc module copies larger
> memory area than the allocated on Ubuntu Hardy.
> Because of this problem, NFS users might encounter oops. See Bug #224750.
>
> This bug is derived from Linux 2.6.24 in kernel.org.
> It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
> 86d61d8638ddf9cdf87df26c7fa69b2804425fbe.
>
> I don't know how important it is for Ubuntu users, but I made the
> patch to solve it, which is the attachment.
>
> Regards,
>
> --
> HIRANO Takahito
> hiranotaka@zng.info
>

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

HIRANO Takahito wrote:
> I lost some mails from Tim (maybe my MTA sucks...), so I'm replying to myself.
>
> I sent the patch to stable@kernel.org,
> but I don't think it will be accepted because the maintenance of
> 2.6.24.y has finished.
>
> Thanks,
> HIRANO Takahito
>
> 2008/5/2 HIRANO Takahito <hiranotaka@zng.info>:
>> Hello,
>>
>> The rpcb_getport_async function in the sunrpc module copies larger
>> memory area than the allocated on Ubuntu Hardy.
>> Because of this problem, NFS users might encounter oops. See Bug #224750.
>>
>> This bug is derived from Linux 2.6.24 in kernel.org.
>> It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
>> 86d61d8638ddf9cdf87df26c7fa69b2804425fbe.
>>
>> I don't know how important it is for Ubuntu users, but I made the
>> patch to solve it, which is the attachment.
>>
>> Regards,
>>
>> --
>> HIRANO Takahito
>> hiranotaka@zng.info
>>
>

Hirano - can you describe a short test case that causes this kernel crash?

--
Tim Gardner tim.gardner@ubuntu.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

Tim,

This oops occurs when the local sunrpc module queries the port number
to the remote portmap daemon, typically on mount or lock to NFS.
This is not always reproducible because the improperly copied memory
area might be accessible by chance.

Regards,

HIRANO Takahito

> Hirano - can you describe a short test case that causes this kernel crash?
>
> --
> Tim Gardner tim.gardner at ubuntu.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

FYI, the patch was rejected in kernel.org by Greg K-H:
> The 2.6.24.y kernel tree is pretty much "closed" now, we don't want to
> do any more releases of it, so I'm not going to add this to any queue,
> sorry.

2008/5/3 HIRANO Takahito <hiranotaka@zng.info>:
> I lost some mails from Tim (maybe my MTA sucks...), so I'm replying to myself.
>
> I sent the patch to stable@kernel.org,
> but I don't think it will be accepted because the maintenance of
> 2.6.24.y has finished.
>
> Thanks,
> HIRANO Takahito
>
> 2008/5/2 HIRANO Takahito <hiranotaka@zng.info>:
>
>
> > Hello,
> >
> > The rpcb_getport_async function in the sunrpc module copies larger
> > memory area than the allocated on Ubuntu Hardy.
> > Because of this problem, NFS users might encounter oops. See Bug #224750.
> >
> > This bug is derived from Linux 2.6.24 in kernel.org.
> > It seems to be fixed on Linux 2.6.25 in kernel.org by the commit
> > 86d61d8638ddf9cdf87df26c7fa69b2804425fbe.
> >
> > I don't know how important it is for Ubuntu users, but I made the
> > patch to solve it, which is the attachment.
> >
> > Regards,
> >
> > --
> > HIRANO Takahito
> > hiranotaka@zng.info
> >
>


--
HIRANO Takahito
hiranotaka@zng.jp

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team