netdev - [PATCH v2 0/4] nfsd/sunrpc: cleanup resource with sync mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241225065908.1547645-1-yangerkun@huawei.com>
Date: Wed, 25 Dec 2024 14:59:04 +0800
From: Yang Erkun <yangerkun@...wei.com>
To: chuck.lever@...cle.com,
	jlayton@...nel.org,
	neilb@...e.de,
	okorniev@...hat.com,
	Dai.Ngo@...cle.com,
	tom@...pey.com,
	trondmy@...nel.org,
	anna@...nel.org,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	horms@...nel.org
Cc: linux-nfs@...r.kernel.org,
	netdev@...r.kernel.org,
	yangerkun@...wei.com,
	yangerkun@...weicloud.com,
	liumingrui@...wei.com
Subject: [PATCH v2 0/4] nfsd/sunrpc: cleanup resource with sync mode

After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with
rcu_work"), svc_export_put/expkey_put will call path_put with async
mode. This can lead some unexpected failure:

mkdir /mnt/sda
mkfs.xfs -f /dev/sda
echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports
echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports
exportfs -ra
service nfs-server start
mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1
mount /dev/sda /mnt/sda
touch /mnt1/sda/file
exportfs -r
umount /mnt/sda # failed unexcepted

The touch above will finally call nfsd_cross_mnt, add refcount to mount,
and then add cache_head. Before this commit, exportfs -r will call
cache_flush to cleanup all cache_head, and path_put in
svc_export_put/expkey_put will be finished with sync mode. So, the
latter umount will always success. However, after this commit, path_put
will be called with async mode, the latter umount may failed, and if we
add some delay, umount will success too. Personally I think this bug and
should be fixed. We first revert before bugfix patch, and then fix the
original bug with a different way.

v1->v2:

1. do not change cache_check, instead add cache_check_rcu and use it in
c_show/e_show
2. the first patch has been applied

Yang Erkun (4):
  SUNRPC: introduce cache_check_rcu to help check in rcu context
  nfsd: no need get cache ref when protected by rcu
  SUNRPC: no need get cache ref when protected by rcu
  nfsd: fix UAF when access ex_uuid or ex_stats

 fs/nfsd/export.c             | 25 ++++++++++-------
 include/linux/sunrpc/cache.h |  2 ++
 net/sunrpc/cache.c           | 53 ++++++++++++++++++++----------------
 3 files changed, 46 insertions(+), 34 deletions(-)

-- 
2.46.1