| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 28 Sep 2021 11:14:40 +0800
From: Wang Hai <wanghai38@...wei.com>
To: <bfields@...ldses.org>, <davem@...emloft.net>, <kuba@...nel.org>,
<wenbin.zeng@...il.com>, <jlayton@...nel.org>, <dsahern@...il.com>,
<nicolas.dichtel@...nd.com>, <viro@...iv.linux.org.uk>,
<willy@...radead.org>, <jakub.kicinski@...ronome.com>,
<tyhicks@...onical.com>, <cong.wang@...edance.com>,
<ast@...nel.org>, <jiang.wang@...edance.com>,
<christian.brauner@...ntu.com>, <edumazet@...gle.com>,
<Rao.Shoaib@...cle.com>, <kuniyu@...zon.co.jp>,
<trond.myklebust@...merspace.com>, <anna.schumaker@...app.com>,
<chuck.lever@...cle.com>, <neilb@...e.com>, <kolga@...app.com>,
<timo@...henpieler.org>, <tom@...pey.com>
CC: <linux-nfs@...r.kernel.org>, <netdev@...r.kernel.org>,
<linux-kernel@...r.kernel.org>
Subject: [PATCH net 2/2] auth_gss: Fix deadlock that blocks rpcsec_gss_exit_net when use-gss-proxy==1
When use-gss-proxy is set to 1, write_gssp() creates a rpc client in
gssp_rpc_create(), this increases the netns refcount by 2, these
refcounts are supposed to be released in rpcsec_gss_exit_net(), but it
will never happen because rpcsec_gss_exit_net() is triggered only when
the netns refcount gets to 0, specifically:
refcount=0 -> cleanup_net() -> ops_exit_list -> rpcsec_gss_exit_net
It is a deadlock situation here, refcount will never get to 0 unless
rpcsec_gss_exit_net() is called. So, in this case, the netns refcount
should not be increased.
In this case, xprt will take a netns refcount which is not supposed
to be taken. Add a new flag to rpc_create_args called
RPC_CLNT_CREATE_NO_NET_REF for not increasing the netns refcount.
It is safe not to hold the netns refcount, because when cleanup_net(), it
will hold the gssp_lock and then shut down the rpc client synchronously.
Signed-off-by: Wang Hai <wanghai38@...wei.com>
---
include/linux/sunrpc/clnt.h | 1 +
include/linux/sunrpc/xprt.h | 6 ++++--
net/sunrpc/auth_gss/gss_rpc_upcall.c | 3 ++-
net/sunrpc/clnt.c | 2 ++
net/sunrpc/xprt.c | 13 +++++++++----
net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 2 +-
net/sunrpc/xprtrdma/transport.c | 2 +-
net/sunrpc/xprtsock.c | 4 +++-
8 files changed, 23 insertions(+), 10 deletions(-)
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index a4661646adc9..6323518e7b1c 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -159,6 +159,7 @@ struct rpc_add_xprt_test {
#define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9)
#define RPC_CLNT_CREATE_SOFTERR (1UL << 10)
#define RPC_CLNT_CREATE_REUSEPORT (1UL << 11)
+#define RPC_CLNT_CREATE_NO_NET_REF (1UL << 12)
struct rpc_clnt *rpc_create(struct rpc_create_args *args);
struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *,
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 955ea4d7af0b..cc518a58b93c 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -284,6 +284,7 @@ struct rpc_xprt {
} stat;
struct net *xprt_net;
+ bool xprt_net_refcnt;
const char *servername;
const char *address_strings[RPC_DISPLAY_MAX];
#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
@@ -317,6 +318,7 @@ static inline int bc_prealloc(struct rpc_rqst *req)
#define XPRT_CREATE_INFINITE_SLOTS (1U)
#define XPRT_CREATE_NO_IDLE_TIMEOUT (1U << 1)
+#define XPRT_CREATE_NO_NET_REF (1U << 2)
struct xprt_create {
int ident; /* XPRT_TRANSPORT identifier */
@@ -370,8 +372,8 @@ void xprt_release(struct rpc_task *task);
struct rpc_xprt * xprt_get(struct rpc_xprt *xprt);
void xprt_put(struct rpc_xprt *xprt);
struct rpc_xprt * xprt_alloc(struct net *net, size_t size,
- unsigned int num_prealloc,
- unsigned int max_req);
+ unsigned int num_prealloc,
+ unsigned int max_req, bool xprt_net_refcnt);
void xprt_free(struct rpc_xprt *);
void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task);
bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req);
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index 61c276bddaf2..8c35805470d5 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -98,7 +98,8 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
* done without the correct namespace:
*/
.flags = RPC_CLNT_CREATE_NOPING |
- RPC_CLNT_CREATE_NO_IDLE_TIMEOUT
+ RPC_CLNT_CREATE_NO_IDLE_TIMEOUT |
+ RPC_CLNT_CREATE_NO_NET_REF
};
struct rpc_clnt *clnt;
int result = 0;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index f056ff931444..672bebae50ca 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -543,6 +543,8 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
xprtargs.flags |= XPRT_CREATE_INFINITE_SLOTS;
if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT)
xprtargs.flags |= XPRT_CREATE_NO_IDLE_TIMEOUT;
+ if (args->flags & RPC_CLNT_CREATE_NO_NET_REF)
+ xprtargs.flags |= XPRT_CREATE_NO_NET_REF;
/*
* If the caller chooses not to specify a hostname, whip
* up a string representation of the passed-in address.
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index cfd681700d1a..ffa6de06f21b 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1794,8 +1794,8 @@ static void xprt_free_id(struct rpc_xprt *xprt)
}
struct rpc_xprt *xprt_alloc(struct net *net, size_t size,
- unsigned int num_prealloc,
- unsigned int max_alloc)
+ unsigned int num_prealloc,
+ unsigned int max_alloc, bool xprt_net_refcnt)
{
struct rpc_xprt *xprt;
struct rpc_rqst *req;
@@ -1806,6 +1806,7 @@ struct rpc_xprt *xprt_alloc(struct net *net, size_t size,
goto out;
xprt_alloc_id(xprt);
+ xprt->xprt_net_refcnt = xprt_net_refcnt;
xprt_init(xprt, net);
for (i = 0; i < num_prealloc; i++) {
@@ -1832,7 +1833,8 @@ EXPORT_SYMBOL_GPL(xprt_alloc);
void xprt_free(struct rpc_xprt *xprt)
{
- put_net(xprt->xprt_net);
+ if (xprt->xprt_net_refcnt)
+ put_net(xprt->xprt_net);
xprt_free_all_slots(xprt);
xprt_free_id(xprt);
rpc_sysfs_xprt_destroy(xprt);
@@ -2024,7 +2026,10 @@ static void xprt_init(struct rpc_xprt *xprt, struct net *net)
xprt_init_xid(xprt);
- xprt->xprt_net = get_net(net);
+ if (xprt->xprt_net_refcnt)
+ xprt->xprt_net = get_net(net);
+ else
+ xprt->xprt_net = net;
}
/**
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index 16897fcb659c..8cd7a38da0f0 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -251,7 +251,7 @@ xprt_setup_rdma_bc(struct xprt_create *args)
xprt = xprt_alloc(args->net, sizeof(*new_xprt),
RPCRDMA_MAX_BC_REQUESTS,
- RPCRDMA_MAX_BC_REQUESTS);
+ RPCRDMA_MAX_BC_REQUESTS, true);
if (!xprt)
return ERR_PTR(-ENOMEM);
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 16e5696314a4..f0f7faa571f6 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -323,7 +323,7 @@ xprt_setup_rdma(struct xprt_create *args)
return ERR_PTR(-EIO);
xprt = xprt_alloc(args->net, sizeof(struct rpcrdma_xprt), 0,
- xprt_rdma_slot_table_entries);
+ xprt_rdma_slot_table_entries, true);
if (!xprt) {
module_put(THIS_MODULE);
return ERR_PTR(-ENOMEM);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 04f1b78bcbca..b6c15159992a 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2740,6 +2740,8 @@ static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
{
struct rpc_xprt *xprt;
struct sock_xprt *new;
+ bool xprt_net_refcnt = args->flags & XPRT_CREATE_NO_NET_REF ?
+ false : true;
if (args->addrlen > sizeof(xprt->addr)) {
dprintk("RPC: xs_setup_xprt: address too large\n");
@@ -2747,7 +2749,7 @@ static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
}
xprt = xprt_alloc(args->net, sizeof(*new), slot_table_size,
- max_slot_table_size);
+ max_slot_table_size, xprt_net_refcnt);
if (xprt == NULL) {
dprintk("RPC: xs_setup_xprt: couldn't allocate "
"rpc_xprt\n");
--
2.17.1
Powered by blists - more mailing lists