rpc.lockd(8) seg faults on 5.2-RELEASE

[Don Lewis]

On  3 Feb, Frode Nordahl wrote:
> Hello,
> 
> Got a better backtrace now:
> (gdb) bt
> #0  0x280b51bc in bcmp () from /lib/libc.so.5
> #1  0x08073080 in ?? ()
> #2  0x0804ed3b in unlock_nfslock (fl=0xbfbfe0a0, 
> released_lock=0xbfbfe04c,
>      left_lock=0xbfbfe054, right_lock=0xbfbfe050) at lockd_lock.c:976
> #3  0x0804f778 in unlock_partialfilelock (fl=0xbfbfe0a0) at 
> lockd_lock.c:1477
> #4  0x0804fd6d in do_unlock (fl=0xbfbfe0a0) at lockd_lock.c:1788
> #5  0x08050181 in unlock (lock=0xbfbfe568, flags=2) at lockd_lock.c:1967
> #6  0x0804d338 in nlm4_unlock_4_svc (arg=0xbfbfe560, rqstp=0xbfbfeab0)
>      at lock_proc.c:1120
> #7  0x0804b449 in nlm_prog_4 (rqstp=0xbfbfeab0, transp=0x8073080)
>      at nlm_prot_svc.c:436
> #8  0x280f67d8 in svc_getreq_common () from /lib/libc.so.5
> #9  0x280f65af in svc_getreqset () from /lib/libc.so.5
> #10 0x280b5ea4 in svc_run () from /lib/libc.so.5
> #11 0x0804b97c in main (argc=1, argv=0xbfbfed10) at lockd.c:212
> #12 0x08049962 in _start ()
> (gdb) frame 2
> #2  0x0804ed3b in unlock_nfslock (fl=0xbfbfe0a0, 
> released_lock=0xbfbfe04c,
>      left_lock=0xbfbfe054, right_lock=0xbfbfe050) at lockd_lock.c:976
> 976             mfl = get_lock_matching_unlock(fl);
> (gdb)
> 
> bcmp call in get_lock_matching_unlock():
>                  if (bcmp(&fl->filehandle, &ifl->filehandle, 
> sizeof(fhandle_t)))
>                          continue;
> 
> Since it dies on bcmp, it seems like a null lock gets into the list for 
> some reason.

Probably not a NULL pointer because &ifl->filehandle will be the same
value as (char *)ifl+offsetof(struct file_lock, filehandle), and
LIST_FOREACH() will bail out when ifl is NULL.  It would be interesting
to walk the lock list starting at nfslocklist_head and following the
nfslocklist links so see if any of the link values look bogus.