kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/include/linux/sunrpc
History
felix 7749fd2dbe SUNRPC: Fix RPC client cleaned up the freed pipefs dentries 
[ Upstream commit bfca5fb4e9 ]

RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()
workqueue,which takes care about pipefs superblock locking.
In some special scenarios, when kernel frees the pipefs sb of the
current client and immediately alloctes a new pipefs sb,
rpc_remove_pipedir function would misjudge the existence of pipefs
sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.

To fix this issue, rpc_remove_pipedir should check whether the
current pipefs sb is consistent with the original pipefs sb.

This error can be catched by KASAN:
=========================================================
[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200
[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503
[  250.500549] Workqueue: events rpc_free_client_work
[  250.501001] Call Trace:
[  250.502880]  kasan_report+0xb6/0xf0
[  250.503209]  ? dget_parent+0x195/0x200
[  250.503561]  dget_parent+0x195/0x200
[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10
[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90
[  250.504781]  rpc_remove_client_dir+0xf5/0x150
[  250.505195]  rpc_free_client_work+0xe4/0x230
[  250.505598]  process_one_work+0x8ee/0x13b0
...
[   22.039056] Allocated by task 244:
[   22.039390]  kasan_save_stack+0x22/0x50
[   22.039758]  kasan_set_track+0x25/0x30
[   22.040109]  __kasan_slab_alloc+0x59/0x70
[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240
[   22.040889]  __d_alloc+0x31/0x8e0
[   22.041207]  d_alloc+0x44/0x1f0
[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140
[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110
[   22.042459]  rpc_create_client_dir+0x34/0x150
[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0
[   22.043284]  rpc_client_register+0x136/0x4e0
[   22.043689]  rpc_new_client+0x911/0x1020
[   22.044057]  rpc_create_xprt+0xcb/0x370
[   22.044417]  rpc_create+0x36b/0x6c0
...
[   22.049524] Freed by task 0:
[   22.049803]  kasan_save_stack+0x22/0x50
[   22.050165]  kasan_set_track+0x25/0x30
[   22.050520]  kasan_save_free_info+0x2b/0x50
[   22.050921]  __kasan_slab_free+0x10e/0x1a0
[   22.051306]  kmem_cache_free+0xa5/0x390
[   22.051667]  rcu_core+0x62c/0x1930
[   22.051995]  __do_softirq+0x165/0x52a
[   22.052347]
[   22.052503] Last potentially related work creation:
[   22.052952]  kasan_save_stack+0x22/0x50
[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0
[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0
[   22.054209]  dentry_free+0xb2/0x140
[   22.054540]  __dentry_kill+0x3be/0x540
[   22.054900]  shrink_dentry_list+0x199/0x510
[   22.055293]  shrink_dcache_parent+0x190/0x240
[   22.055703]  do_one_tree+0x11/0x40
[   22.056028]  shrink_dcache_for_umount+0x61/0x140
[   22.056461]  generic_shutdown_super+0x70/0x590
[   22.056879]  kill_anon_super+0x3a/0x60
[   22.057234]  rpc_kill_sb+0x121/0x200

Fixes: 0157d021d2 ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines")
Signed-off-by: felix <fuzhen5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-11-28 17:07:04 +00:00
..
addr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
auth.h SUNRPC/auth: async tasks mustn't block waiting for memory 2022-03-13 12:59:35 -04:00
auth_gss.h sunrpc: remove __KERNEL__ ifdefs 2019-11-12 11:43:29 -05:00
bc_xprt.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_149.RULE 2022-06-10 14:51:35 +02:00
cache.h SUNRPC: Make cache_req::thread_wait an unsigned long 2022-05-19 12:25:39 -04:00
clnt.h SUNRPC: Fix RPC client cleaned up the freed pipefs dentries 2023-11-28 17:07:04 +00:00
debug.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
gss_api.h sunrpc: clean up properly in gss_mech_unregister() 2020-05-28 18:15:00 -04:00
gss_asn1.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
gss_err.h sunrpc: remove __KERNEL__ ifdefs 2019-11-12 11:43:29 -05:00
gss_krb5.h SUNRPC: remove RC4-HMAC-MD5 support from KerberosV 2020-09-11 14:39:15 +10:00
gss_krb5_enctypes.h SUNRPC: remove RC4-HMAC-MD5 support from KerberosV 2020-09-11 14:39:15 +10:00
metrics.h SUNRPC: Count ops completing with tk_status < 0 2019-07-06 14:54:51 -04:00
msg_prot.h SUNRPC: Add RPC_AUTH_TLS protocol numbers 2021-08-17 11:47:53 -04:00
rpc_pipe_fs.h SUNRPC: ensure the matching upcall is in-flight upon downcall 2023-01-12 12:01:56 +01:00
rpc_rdma.h svcrdma: Add common XDR encoders for RDMA and Read segments 2020-07-13 17:28:24 -04:00
rpc_rdma_cid.h svcrdma: Introduce infrastructure to support completion IDs 2020-07-13 17:28:24 -04:00
sched.h SUNRPC: remove the maximum number of retries in call_bind_status 2023-05-11 23:03:35 +09:00
stats.h proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
svc.h SUNRPC: Parametrize how much of argsize should be zeroed 2022-09-26 14:02:42 -04:00
svc_rdma.h SUNRPC: always free ctxt when freeing deferred request 2023-05-24 17:32:45 +01:00
svc_rdma_pcl.h svcrdma: Add a "parsed chunk list" data structure 2020-11-30 13:00:22 -05:00
svc_xprt.h SUNRPC: always free ctxt when freeing deferred request 2023-05-24 17:32:45 +01:00
svcauth.h SUNRPC: Add svc_rqst::rq_auth_stat 2021-08-10 14:18:35 -04:00
svcauth_gss.h sunrpc: clean up properly in gss_mech_unregister() 2020-05-28 18:15:00 -04:00
svcsock.h nfsd: fix double fget() bug in __write_ports_addfd() 2023-06-09 10:34:04 +02:00
timer.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
types.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xdr.h NFSD: Refactor common code out of dirlist helpers 2022-09-26 14:02:47 -04:00
xprt.h SUNRPC: Don't reuse bvec on retransmission of the request 2022-07-27 16:26:17 -04:00
xprtmultipath.h SUNRPC export xprt_iter_rewind function 2022-07-25 10:06:04 -04:00
xprtrdma.h xprtrdma: Boost client's max slot table size to match Linux server 2019-08-20 11:17:16 -04:00
xprtsock.h SUNRPC: Do not dereference non-socket transports in sysfs 2022-03-25 13:22:58 -04:00