linux-kernel - Re: [PATCH AUTOSEL for 4.4 19/35] nfsd: Ensure we don't recognise lock stateids after freeing them

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 24 Jan 2018 10:48:27 -0500
From:   "J. Bruce Fields" <bfields@...hat.com>
To:     Sasha Levin <Alexander.Levin@...rosoft.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Trond Myklebust <trond.myklebust@...marydata.com>
Subject: Re: [PATCH AUTOSEL for 4.4 19/35] nfsd: Ensure we don't recognise
 lock stateids after freeing them

Ditto.--b.

On Wed, Jan 24, 2018 at 04:17:02AM +0000, Sasha Levin wrote:
> From: Trond Myklebust <trond.myklebust@...marydata.com>
> 
> [ Upstream commit 659aefb68eca28ba9aa482a9fc64de107332e256 ]
> 
> In order to deal with lookup races, nfsd4_free_lock_stateid() needs
> to be able to signal to other stateful functions that the lock stateid
> is no longer valid. Right now, nfsd_lock() will check whether or not an
> existing stateid is still hashed, but only in the "new lock" path.
> 
> To ensure the stateid invalidation is also recognised by the "existing lock"
> path, and also by a second call to nfsd4_free_lock_stateid() itself, we can
> change the type to NFS4_CLOSED_STID under the stp->st_mutex.
> 
> Signed-off-by: Trond Myklebust <trond.myklebust@...marydata.com>
> Signed-off-by: J. Bruce Fields <bfields@...hat.com>
> Signed-off-by: Sasha Levin <alexander.levin@...rosoft.com>
> ---
>  fs/nfsd/nfs4state.c | 19 ++++++++-----------
>  1 file changed, 8 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index d31b6cdefb9d..439f01a0bc49 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -4934,7 +4934,9 @@ nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
>  	struct nfs4_ol_stateid *stp = openlockstateid(s);
>  	__be32 ret;
>  
> -	mutex_lock(&stp->st_mutex);
> +	ret = nfsd4_lock_ol_stateid(stp);
> +	if (ret)
> +		goto out_put_stid;
>  
>  	ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
>  	if (ret)
> @@ -4945,11 +4947,13 @@ nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
>  			    lockowner(stp->st_stateowner)))
>  		goto out;
>  
> +	stp->st_stid.sc_type = NFS4_CLOSED_STID;
>  	release_lock_stateid(stp);
>  	ret = nfs_ok;
>  
>  out:
>  	mutex_unlock(&stp->st_mutex);
> +out_put_stid:
>  	nfs4_put_stid(s);
>  	return ret;
>  }
> @@ -5489,6 +5493,8 @@ find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
>  	lockdep_assert_held(&clp->cl_lock);
>  
>  	list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
> +		if (lst->st_stid.sc_type != NFS4_LOCK_STID)
> +			continue;
>  		if (lst->st_stid.sc_file == fp) {
>  			atomic_inc(&lst->st_stid.sc_count);
>  			return lst;
> @@ -5563,7 +5569,6 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
>  	struct nfs4_lockowner *lo;
>  	struct nfs4_ol_stateid *lst;
>  	unsigned int strhashval;
> -	bool hashed;
>  
>  	lo = find_lockowner_str(cl, &lock->lk_new_owner);
>  	if (!lo) {
> @@ -5586,15 +5591,7 @@ retry:
>  		goto out;
>  	}
>  
> -	mutex_lock(&lst->st_mutex);
> -
> -	/* See if it's still hashed to avoid race with FREE_STATEID */
> -	spin_lock(&cl->cl_lock);
> -	hashed = !list_empty(&lst->st_perfile);
> -	spin_unlock(&cl->cl_lock);
> -
> -	if (!hashed) {
> -		mutex_unlock(&lst->st_mutex);
> +	if (nfsd4_lock_ol_stateid(lst) != nfs_ok) {
>  		nfs4_put_stid(&lst->st_stid);
>  		goto retry;
>  	}
> -- 
> 2.11.0