From: J. Bruce Fields Date: Tue, 5 Dec 2006 01:22:32 +0000 (-0500) Subject: rpc: gss: fix a kmap_atomic race in krb5 code X-Git-Tag: v2.6.20-rc1~34^2~412^2~30 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=87d918d667e51962938392759aef6ca368d6e96d;p=linux-2.6 rpc: gss: fix a kmap_atomic race in krb5 code This code is never called from interrupt context; it's always run by either a user thread or rpciod. So KM_SKB_SUNRPC_DATA is inappropriate here. Thanks to Aimé Le Rouzic for capturing an oops which showed the kernel taking an interrupt while we were in this piece of code, resulting in a nested kmap_atomic(.,KM_SKB_SUNRPC_DATA) call from xdr_partial_copy_from_skb(). Signed-off-by: J. Bruce Fields Signed-off-by: Trond Myklebust --- diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c index 0f512e8e0d..ad243872f5 100644 --- a/net/sunrpc/auth_gss/gss_krb5_wrap.c +++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c @@ -57,9 +57,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize) >>PAGE_CACHE_SHIFT; int offset = (buf->page_base + len - 1) & (PAGE_CACHE_SIZE - 1); - ptr = kmap_atomic(buf->pages[last], KM_SKB_SUNRPC_DATA); + ptr = kmap_atomic(buf->pages[last], KM_USER0); pad = *(ptr + offset); - kunmap_atomic(ptr, KM_SKB_SUNRPC_DATA); + kunmap_atomic(ptr, KM_USER0); goto out; } else len -= buf->page_len;