linux-kernel - Re: [PATCH] nfsd: validate the nfsd_serv pointer before calling svc_wake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <02eefb82ddff92f3797c346033300b7d259267d6.camel@kernel.org>
Date: Sun, 26 Jan 2025 07:36:37 -0500
From: Jeff Layton <jlayton@...nel.org>
To: NeilBrown <neilb@...e.de>
Cc: Chuck Lever <chuck.lever@...cle.com>, Olga Kornievskaia	
 <okorniev@...hat.com>, Dai Ngo <Dai.Ngo@...cle.com>, Tom Talpey
 <tom@...pey.com>,  Salvatore Bonaccorso	 <carnil@...ian.org>,
 linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] nfsd: validate the nfsd_serv pointer before calling
 svc_wake_up

On Sun, 2025-01-26 at 13:39 +1100, NeilBrown wrote:
> On Sun, 26 Jan 2025, Jeff Layton wrote:
> > nfsd_file_dispose_list_delayed can be called from the filecache
> > laundrette, which is shut down after the nfsd threads are shut down and
> > the nfsd_serv pointer is cleared. If nn->nfsd_serv is NULL then there
> > are no threads to wake.
> > 
> > Ensure that the nn->nfsd_serv pointer is non-NULL before calling
> > svc_wake_up in nfsd_file_dispose_list_delayed. This is safe since the
> > svc_serv is not freed until after the filecache laundrette is cancelled.
> > 
> > Fixes: ffb402596147 ("nfsd: Don't leave work of closing files to a work queue")
> > Reported-by: Salvatore Bonaccorso <carnil@...ian.org>
> > Closes: https://lore.kernel.org/linux-nfs/7d9f2a8aede4f7ca9935a47e1d405643220d7946.camel@kernel.org/
> > Signed-off-by: Jeff Layton <jlayton@...nel.org>
> > ---
> > This is only lightly tested, but I think it will fix the bug that
> > Salvatore reported.
> > ---
> >  fs/nfsd/filecache.c | 11 ++++++++++-
> >  1 file changed, 10 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> > index e91c164b5ea21507659904690533a19ca43b1b64..fb2a4469b7a3c077de2dd750f43239b4af6d37b0 100644
> > --- a/fs/nfsd/filecache.c
> > +++ b/fs/nfsd/filecache.c
> > @@ -445,11 +445,20 @@ nfsd_file_dispose_list_delayed(struct list_head *dispose)
> >  						struct nfsd_file, nf_gc);
> >  		struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
> >  		struct nfsd_fcache_disposal *l = nn->fcache_disposal;
> > +		struct svc_serv *serv;
> >  
> >  		spin_lock(&l->lock);
> >  		list_move_tail(&nf->nf_gc, &l->freeme);
> >  		spin_unlock(&l->lock);
> > -		svc_wake_up(nn->nfsd_serv);
> > +
> > +		/*
> > +		 * The filecache laundrette is shut down after the
> > +		 * nn->nfsd_serv pointer is cleared, but before the
> > +		 * svc_serv is freed.
> > +		 */
> > +		serv = nn->nfsd_serv;
> 
> I wonder if this should be READ_ONCE() to tell the compiler that we
> could race with clearing nn->nfsd_serv.  Would the comment still be
> needed?
> 

I think we need a comment at least. The linkage between the laundrette
and the nfsd_serv being set to NULL is very subtle. A READ_ONCE()
doesn't convey that well, and is unnecessary here.

> Otherwise:
> 
>  Reviewed-by: NeilBrown <neilb@...e.de>
> 

Thanks!

> 
> > +		if (serv)
> > +			svc_wake_up(serv);
> >  	}
> >  }
> >  
> > 
> > ---
> > base-commit: 7541a5b8073cf0d9e2d288cac581f1aa6c11671d
> > change-id: 20250125-kdevops-0989825ae8db
> > 
> > Best regards,
> > -- 
> > Jeff Layton <jlayton@...nel.org>
> > 
> > 
> 

-- 
Jeff Layton <jlayton@...nel.org>