| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <f6e3444ca2b798d1f8d6b481ed6b848ec15d44c9.camel@kernel.org>
Date: Wed, 03 Jan 2024 10:20:45 -0500
From: Jeff Layton <jlayton@...nel.org>
To: Chuck Lever <chuck.lever@...cle.com>
Cc: Neil Brown <neilb@...e.de>, Olga Kornievskaia <kolga@...app.com>, Dai
Ngo <Dai.Ngo@...cle.com>, Tom Talpey <tom@...pey.com>,
linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org, Zhi Li
<yieli@...hat.com>
Subject: Re: [PATCH] nfsd: drop the nfsd_put helper
On Wed, 2024-01-03 at 09:48 -0500, Chuck Lever wrote:
> On Wed, Jan 03, 2024 at 08:36:52AM -0500, Jeff Layton wrote:
> > It's not safe to call nfsd_put once nfsd_last_thread has been called, as
> > that function will zero out the nn->nfsd_serv pointer.
> >
> > Drop the nfsd_put helper altogether and open-code the svc_put in its
> > callers instead. That allows us to not be reliant on the value of that
> > pointer when handling an error.
> >
> > Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()")
> > Reported-by: Zhi Li <yieli@...hat.com>
> > Cc: NeilBrown <neilb@...e.de>
> > Signed-off-by: Jeffrey Layton <jlayton@...hat.com>
> > ---
> > I know it's late, but it would be good to get this into v6.7 if
> > possible. I think it's fairly straightforward.
>
> How is Zhi finding these? Are there administrative API tests that
> can be shared with the community (say, by adding them to kdevops)?
>
>
I wish I knew. In most of these, we see these messages ahead of the
KASAN pops that he's reporting:
[ 643.617739] NFSD: Using UMH upcall client tracking operations.
[ 643.617755] NFSD: starting 90-second grace period (net f0000000)
[ 643.780487] svc: failed to register nfsdv3 RPC service (errno 512).
[ 643.780928] svc: failed to register nfsaclv3 RPC service (errno 512).
[ 643.794625] ==================================================================
[ 643.794635] BUG: KASAN: null-ptr-deref in __write_ports_addfd+0x3b9/0x6c0 [nfsd]
[ 643.794779] Write of size 4 at addr 0000000000000058 by task rpc.nfsd/16702
[ 643.794783]
...
The errno 512 makes me suspect that the rpcbind registration attempt is
catching a signal, and that failure then bubbles up when we're trying to
start the server. I've not been able to reproduce this myself though.
> > ---
> > fs/nfsd/nfsctl.c | 31 +++++++++++++++++--------------
> > fs/nfsd/nfsd.h | 7 -------
> > 2 files changed, 17 insertions(+), 21 deletions(-)
> >
> > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> > index 7cd513e59305..87fed75808ff 100644
> > --- a/fs/nfsd/nfsctl.c
> > +++ b/fs/nfsd/nfsctl.c
> > @@ -693,6 +693,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred
> > char *mesg = buf;
> > int fd, err;
> > struct nfsd_net *nn = net_generic(net, nfsd_net_id);
> > + struct svc_serv *serv;
> >
> > err = get_int(&mesg, &fd);
> > if (err != 0 || fd < 0)
> > @@ -703,15 +704,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred
> > if (err != 0)
> > return err;
> >
> > - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
> > + serv = nn->nfsd_serv;
> > + err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
> >
> > - if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
> > + if (err < 0 && !serv->sv_nrthreads && !nn->keep_active)
> > nfsd_last_thread(net);
> > - else if (err >= 0 &&
> > - !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
> > - svc_get(nn->nfsd_serv);
> > + else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
> > + svc_get(serv);
> >
> > - nfsd_put(net);
> > + svc_put(serv);
> > return err;
> > }
> >
> > @@ -725,6 +726,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr
> > struct svc_xprt *xprt;
> > int port, err;
> > struct nfsd_net *nn = net_generic(net, nfsd_net_id);
> > + struct svc_serv *serv;
> >
> > if (sscanf(buf, "%15s %5u", transport, &port) != 2)
> > return -EINVAL;
> > @@ -737,32 +739,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr
> > if (err != 0)
> > return err;
> >
> > - err = svc_xprt_create(nn->nfsd_serv, transport, net,
> > + serv = nn->nfsd_serv;
> > + err = svc_xprt_create(serv, transport, net,
> > PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
> > if (err < 0)
> > goto out_err;
> >
> > - err = svc_xprt_create(nn->nfsd_serv, transport, net,
> > + err = svc_xprt_create(serv, transport, net,
> > PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
> > if (err < 0 && err != -EAFNOSUPPORT)
> > goto out_close;
> >
> > - if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
> > - svc_get(nn->nfsd_serv);
> > + if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
> > + svc_get(serv);
> >
> > - nfsd_put(net);
> > + svc_put(serv);
> > return 0;
> > out_close:
> > - xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port);
> > + xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
> > if (xprt != NULL) {
> > svc_xprt_close(xprt);
> > svc_xprt_put(xprt);
> > }
> > out_err:
> > - if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
> > + if (!serv->sv_nrthreads && !nn->keep_active)
> > nfsd_last_thread(net);
> >
> > - nfsd_put(net);
> > + svc_put(serv);
> > return err;
> > }
> >
> > diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
> > index 3286ffacbc56..9ed0e08d16c2 100644
> > --- a/fs/nfsd/nfsd.h
> > +++ b/fs/nfsd/nfsd.h
> > @@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file *);
> > int nfsd_pool_stats_release(struct inode *, struct file *);
> > void nfsd_shutdown_threads(struct net *net);
> >
> > -static inline void nfsd_put(struct net *net)
> > -{
> > - struct nfsd_net *nn = net_generic(net, nfsd_net_id);
> > -
> > - svc_put(nn->nfsd_serv);
> > -}
> > -
> > bool i_am_nfsd(void);
> >
> > struct nfsdfs_client {
> >
> > ---
> > base-commit: 610a9b8f49fbcf1100716370d3b5f6f884a2835a
> > change-id: 20240103-nfsd-fixes-1f1196134a11
> >
> > Best regards,
> > --
> > Jeff Layton <jlayton@...nel.org>
> >
>
--
Jeff Layton <jlayton@...nel.org>
Powered by blists - more mailing lists