linux-kernel - Re: NFSd: NULL-dereference when writing to v4_end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Nov 2018 15:58:49 -0500
From:   "J. Bruce Fields" <bfields@...ldses.org>
To:     Anatoly Trosinenko <anatoly.trosinenko@...il.com>
Cc:     Jeff Layton <jlayton@...nel.org>, linux-nfs@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: NFSd: NULL-dereference when writing to v4_end_grace when server
 is not yet started

On Sun, Nov 25, 2018 at 09:17:10AM +0300, Anatoly Trosinenko wrote:
> When manually exploring the kernel NFSd feature, I have stumbled upon
> a NULL-dereference when writing to v4_end_grace when server is not yet
> started.

Thanks for the report!

I think this is what we want--it's what a lot of the other nfsctl
methods do.

--b.

commit ad5fdf47b4e3
Author: J. Bruce Fields <bfields@...hat.com>
Date:   Tue Nov 27 15:54:17 2018 -0500

    nfsd4: fix crash on writing v4_end_grace before nfsd startup
    
    Anatoly Trosinenko reports that this:
    
    1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
    2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
    3) From `kvm-xfstests shell`:
    
    results in NULL dereference in locks_end_grace.
    
    Check that nfsd has been started before trying to end the grace period.
    
    Reported-by: Anatoly Trosinenko <anatoly.trosinenko@...il.com>
    Signed-off-by: J. Bruce Fields <bfields@...hat.com>

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 6384c9b94898..38b223c1378e 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1126,7 +1126,13 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
 		case 'Y':
 		case 'y':
 		case '1':
+			mutex_lock(&nfsd_mutex);
+			if (nn->nfsd_serv) {
+				mutex_unlock(&nfsd_mutex);
+				return -EBUSY;
+			}
 			nfsd4_end_grace(nn);
+			mutex_unlock(&nfsd_mutex);
 			break;
 		default:
 			return -EINVAL;