netdev - [RFC PATCH 0/5] nfsd/sunrpc: cleanup resource with sync mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241216142156.4133267-1-yangerkun@huaweicloud.com>
Date: Mon, 16 Dec 2024 22:21:51 +0800
From: Yang Erkun <yangerkun@...weicloud.com>
To: chuck.lever@...cle.com,
	jlayton@...nel.org,
	neilb@...e.de,
	okorniev@...hat.com,
	Dai.Ngo@...cle.com,
	tom@...pey.com,
	trondmy@...nel.org,
	anna@...nel.org,
	linux-nfs@...r.kernel.org,
	netdev@...r.kernel.org
Cc: yangerkun@...wei.com,
	yangerkun@...weicloud.com,
	yi.zhang@...wei.com
Subject: [RFC PATCH 0/5] nfsd/sunrpc: cleanup resource with sync mode

From: Yang Erkun <yangerkun@...wei.com>

After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with
rcu_work"), svc_export_put/expkey_put will call path_put with async
mode. This can lead some unexpected failure:

mkdir /mnt/sda
mkfs.xfs -f /dev/sda
echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports
echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports
exportfs -ra
service nfs-server start
mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1
mount /dev/sda /mnt/sda
touch /mnt1/sda/file
exportfs -r
umount /mnt/sda # failed unexcepted

The touch above will finally call nfsd_cross_mnt, add refcount to mount,
and then add cache_head. Before this commit, exportfs -r will call
cache_flush to cleanup all cache_head, and path_put in
svc_export_put/expkey_put will be finished with sync mode. So, the
latter umount will always success. However, after this commit, path_put
will be called with async mode, the latter umount may failed, and if we
add some delay, umount will success too. Personally I think this bug and
should be fixed. We first revert before bugfix patch, and then fix the
original bug with a different way.

Yang Erkun (5):
  nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
  SUNRPC: move cache_put out from cache_check
  nfsd: no need get cache ref when protected by rcu
  SUNRPC: no need get cache ref when protected by rcu
  nfsd: fix UAF when access ex_uuid or ex_stats

 fs/nfs/dns_resolve.c              |  4 +++-
 fs/nfsd/export.c                  | 34 ++++++++++---------------------
 fs/nfsd/export.h                  |  4 ++--
 fs/nfsd/nfs4idmap.c               |  2 ++
 net/sunrpc/auth_gss/svcauth_gss.c |  9 ++++++--
 net/sunrpc/cache.c                | 11 ++--------
 net/sunrpc/svcauth_unix.c         | 12 ++++++++++-
 7 files changed, 38 insertions(+), 38 deletions(-)

-- 
2.39.2