kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/fs/nfsd
History
Li Lingfeng 318f70857c nfsd: return -EINVAL when namelen is 0 
[ Upstream commit 22451a16b7 ]

When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may
result in namelen being 0, which will cause memdup_user() to return
ZERO_SIZE_PTR.
When we access the name.data that has been assigned the value of
ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is
triggered.

[ T1205] ==================================================================
[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260
[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205
[ T1205]
[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406
[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[ T1205] Call Trace:
[ T1205]  dump_stack+0x9a/0xd0
[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  __kasan_report.cold+0x34/0x84
[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  kasan_report+0x3a/0x50
[ T1205]  nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  ? nfsd4_release_lockowner+0x410/0x410
[ T1205]  cld_pipe_downcall+0x5ca/0x760
[ T1205]  ? nfsd4_cld_tracking_exit+0x1d0/0x1d0
[ T1205]  ? down_write_killable_nested+0x170/0x170
[ T1205]  ? avc_policy_seqno+0x28/0x40
[ T1205]  ? selinux_file_permission+0x1b4/0x1e0
[ T1205]  rpc_pipe_write+0x84/0xb0
[ T1205]  vfs_write+0x143/0x520
[ T1205]  ksys_write+0xc9/0x170
[ T1205]  ? __ia32_sys_read+0x50/0x50
[ T1205]  ? ktime_get_coarse_real_ts64+0xfe/0x110
[ T1205]  ? ktime_get_coarse_real_ts64+0xa2/0x110
[ T1205]  do_syscall_64+0x33/0x40
[ T1205]  entry_SYSCALL_64_after_hwframe+0x67/0xd1
[ T1205] RIP: 0033:0x7fdbdb761bc7
[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514
[ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7
[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008
[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001
[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b
[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000
[ T1205] ==================================================================

Fix it by checking namelen.

Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 74725959c3 ("nfsd: un-deprecate nfsdcld")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Scott Mayhew <smayhew@redhat.com>
Tested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-10-04 16:29:35 +02:00
..
acl.h NFSD: add posix ACLs to struct nfsd_attrs 2022-08-04 10:28:03 -04:00
auth.c cred: get rid of CONFIG_DEBUG_CREDENTIALS 2023-12-20 17:01:51 +01:00
auth.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
blocklayout.c nfsd: call op_release, even when op_func returns an error 2023-03-31 17:29:49 -04:00
blocklayoutxdr.c NFSD: da_addr_body field missing in some GETDEVICEINFO replies 2023-08-29 17:45:22 -04:00
blocklayoutxdr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cache.h nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
current_stateid.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
export.c NFSD: Fix frame size warning in svc_export_parse() 2024-08-19 06:04:22 +02:00
export.h NFSD: Fix frame size warning in svc_export_parse() 2024-08-19 06:04:22 +02:00
filecache.c nfsd: fix refcount leak when file is unhashed after being found 2024-10-04 16:29:32 +02:00
filecache.h NFSD: Convert filecache to rhltable 2023-04-26 09:04:59 -04:00
flexfilelayout.c nfsd: move nfserrno() to vfs.c 2022-11-28 12:54:44 -05:00
flexfilelayoutxdr.c NFSD: da_addr_body field missing in some GETDEVICEINFO replies 2023-08-29 17:45:22 -04:00
flexfilelayoutxdr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
idmap.h nfsd: Remove duplicate define of IDMAP_NAMESZ/IDMAP_TYPE_xx 2015-07-20 14:58:46 -04:00
Kconfig NFS & NFSD: Update GSS dependencies 2023-03-10 09:38:47 -05:00
lockd.c NFSD: simplify struct nfsfh 2021-10-02 15:51:10 -04:00
Makefile nfsd: allow disabling NFSv2 at compile time 2022-11-28 12:54:45 -05:00
netns.h nfsd: make svc_stat per-network namespace instead of global 2024-08-19 06:04:24 +02:00
nfs2acl.c NFSD 6.3 Release Notes 2023-02-22 14:21:40 -08:00
nfs3acl.c NFSD 6.3 Release Notes 2023-02-22 14:21:40 -08:00
nfs3proc.c nfsd: handle failure to collect pre/post-op attrs more sanely 2023-08-29 17:45:22 -04:00
nfs3xdr.c NFSD: Ensure that xdr_write_pages updates rq_next_page 2023-06-05 09:01:44 -04:00
nfs4acl.c nfsd: inherit required unset default acls from effective set 2023-08-29 17:45:22 -04:00
nfs4callback.c NFSD: callback request does not use correct credential for AUTH_SYS 2023-04-04 09:55:27 -04:00
nfs4idmap.c nfsd: call cache_put if xdr_reserve_space returns NULL 2024-10-04 16:29:35 +02:00
nfs4layouts.c nfsd: fix race to check ls_layouts 2023-02-20 09:20:56 -05:00
nfs4proc.c nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
nfs4recover.c nfsd: return -EINVAL when namelen is 0 2024-10-04 16:29:35 +02:00
nfs4state.c nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
nfs4xdr.c NFSD: Fix zero NFSv4 READ results when RQ_SPLICE_OK is not set 2023-09-28 10:34:28 -04:00
nfscache.c nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
nfsctl.c nfsd: make svc_stat per-network namespace instead of global 2024-08-19 06:04:24 +02:00
nfsd.h nfsd: remove nfsd_stats, make th_cnt a global counter 2024-08-19 06:04:24 +02:00
nfsfh.c nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
nfsfh.h nfsd: handle failure to collect pre/post-op attrs more sanely 2023-08-29 17:45:22 -04:00
nfsproc.c NFSD: Hoist rq_vec preparation into nfsd_read() 2023-06-11 16:37:45 -04:00
nfssvc.c NFSD: simplify error paths in nfsd_svc() 2024-08-29 17:33:58 +02:00
nfsxdr.c NFSD: Ensure that xdr_write_pages updates rq_next_page 2023-06-05 09:01:44 -04:00
pnfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
state.h NFSD: handle GETATTR conflict with write delegation 2023-08-29 17:45:22 -04:00
stats.c nfsd: make svc_stat per-network namespace instead of global 2024-08-19 06:04:24 +02:00
stats.h nfsd: make svc_stat per-network namespace instead of global 2024-08-19 06:04:24 +02:00
trace.c NFSD: Add SPDX header for fs/nfsd/trace.c 2020-11-30 13:00:24 -05:00
trace.h NFSD: Fix nfsd_clid_class use of __string_len() macro 2024-04-03 15:28:35 +02:00
vfs.c nfsd: make all of the nfsd stats per-network namespace 2024-08-19 06:04:23 +02:00
vfs.h nfsd: Handle EOPENSTALE correctly in the filecache 2023-11-20 11:58:52 +01:00
xdr.h NFSD: prevent underflow in nfssvc_decode_writeargs() 2022-03-15 09:35:56 -04:00
xdr3.h SUNRPC: Change return value type of .pc_encode 2021-10-13 11:34:49 -04:00
xdr4.h nfsd: remove unsafe BUG_ON from set_change_info 2023-08-29 17:45:22 -04:00
xdr4cb.h NFSD: add support for sending CB_RECALL_ANY 2022-12-10 11:01:12 -05:00