mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-03-22 07:27:12 +08:00
svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit2530766492("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reported-by: Misbah Anjum N <misanjum@linux.ibm.com> Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/ Fixes:c224edca7a("nfsd: no need get cache ref when protected by rcu") Fixes:1b10f0b603("SUNRPC: no need get cache ref when protected by rcu") Cc: stable@vger.kernel.org Reviwed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: NeilBrown <neil@brown.name> Tested-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
143 lines
3.8 KiB
C
143 lines
3.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Copyright (C) 1995-1997 Olaf Kirch <okir@monad.swb.de>
|
|
*/
|
|
#ifndef NFSD_EXPORT_H
|
|
#define NFSD_EXPORT_H
|
|
|
|
#include <linux/sunrpc/cache.h>
|
|
#include <linux/percpu_counter.h>
|
|
#include <linux/workqueue.h>
|
|
#include <uapi/linux/nfsd/export.h>
|
|
#include <linux/nfs4.h>
|
|
|
|
struct knfsd_fh;
|
|
struct svc_fh;
|
|
struct svc_rqst;
|
|
|
|
/*
|
|
* FS Locations
|
|
*/
|
|
|
|
#define MAX_FS_LOCATIONS 128
|
|
|
|
struct nfsd4_fs_location {
|
|
char *hosts; /* colon separated list of hosts */
|
|
char *path; /* slash separated list of path components */
|
|
};
|
|
|
|
struct nfsd4_fs_locations {
|
|
uint32_t locations_count;
|
|
struct nfsd4_fs_location *locations;
|
|
/* If we're not actually serving this data ourselves (only providing a
|
|
* list of replicas that do serve it) then we set "migrated": */
|
|
int migrated;
|
|
};
|
|
|
|
/*
|
|
* We keep an array of pseudoflavors with the export, in order from most
|
|
* to least preferred. For the foreseeable future, we don't expect more
|
|
* than the eight pseudoflavors null, unix, krb5, krb5i, krb5p, skpm3,
|
|
* spkm3i, and spkm3p (and using all 8 at once should be rare).
|
|
*/
|
|
#define MAX_SECINFO_LIST 8
|
|
#define EX_UUID_LEN 16
|
|
|
|
struct exp_flavor_info {
|
|
u32 pseudoflavor;
|
|
u32 flags;
|
|
};
|
|
|
|
/* Per-export stats */
|
|
enum {
|
|
EXP_STATS_FH_STALE,
|
|
EXP_STATS_IO_READ,
|
|
EXP_STATS_IO_WRITE,
|
|
EXP_STATS_COUNTERS_NUM
|
|
};
|
|
|
|
struct export_stats {
|
|
time64_t start_time;
|
|
struct percpu_counter counter[EXP_STATS_COUNTERS_NUM];
|
|
};
|
|
|
|
struct svc_export {
|
|
struct cache_head h;
|
|
struct auth_domain * ex_client;
|
|
int ex_flags;
|
|
int ex_fsid;
|
|
struct path ex_path;
|
|
kuid_t ex_anon_uid;
|
|
kgid_t ex_anon_gid;
|
|
unsigned char * ex_uuid; /* 16 byte fsid */
|
|
struct nfsd4_fs_locations ex_fslocs;
|
|
uint32_t ex_nflavors;
|
|
struct exp_flavor_info ex_flavors[MAX_SECINFO_LIST];
|
|
u32 ex_layout_types;
|
|
struct nfsd4_deviceid_map *ex_devid_map;
|
|
struct cache_detail *cd;
|
|
struct rcu_work ex_rwork;
|
|
unsigned long ex_xprtsec_modes;
|
|
struct export_stats *ex_stats;
|
|
};
|
|
|
|
/* an "export key" (expkey) maps a filehandlefragement to an
|
|
* svc_export for a given client. There can be several per export,
|
|
* for the different fsid types.
|
|
*/
|
|
struct svc_expkey {
|
|
struct cache_head h;
|
|
|
|
struct auth_domain * ek_client;
|
|
u8 ek_fsidtype;
|
|
u32 ek_fsid[6];
|
|
|
|
struct path ek_path;
|
|
struct rcu_work ek_rwork;
|
|
};
|
|
|
|
#define EX_ISSYNC(exp) (!((exp)->ex_flags & NFSEXP_ASYNC))
|
|
#define EX_NOHIDE(exp) ((exp)->ex_flags & NFSEXP_NOHIDE)
|
|
#define EX_WGATHER(exp) ((exp)->ex_flags & NFSEXP_GATHERED_WRITES)
|
|
|
|
struct svc_cred;
|
|
int nfsexp_flags(struct svc_cred *cred, struct svc_export *exp);
|
|
__be32 check_xprtsec_policy(struct svc_export *exp, struct svc_rqst *rqstp);
|
|
__be32 check_security_flavor(struct svc_export *exp, struct svc_rqst *rqstp,
|
|
bool may_bypass_gss);
|
|
__be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp,
|
|
bool may_bypass_gss);
|
|
|
|
/*
|
|
* Function declarations
|
|
*/
|
|
int nfsd_export_wq_init(void);
|
|
void nfsd_export_wq_shutdown(void);
|
|
int nfsd_export_init(struct net *);
|
|
void nfsd_export_shutdown(struct net *);
|
|
void nfsd_export_flush(struct net *);
|
|
struct svc_export * rqst_exp_get_by_name(struct svc_rqst *,
|
|
const struct path *);
|
|
struct svc_export * rqst_exp_parent(struct svc_rqst *,
|
|
struct path *);
|
|
struct svc_export * rqst_find_fsidzero_export(struct svc_rqst *);
|
|
int exp_rootfh(struct net *, struct auth_domain *,
|
|
char *path, struct knfsd_fh *, int maxsize);
|
|
__be32 exp_pseudoroot(struct svc_rqst *, struct svc_fh *);
|
|
|
|
static inline void exp_put(struct svc_export *exp)
|
|
{
|
|
cache_put(&exp->h, exp->cd);
|
|
}
|
|
|
|
static inline struct svc_export *exp_get(struct svc_export *exp)
|
|
{
|
|
cache_get(&exp->h);
|
|
return exp;
|
|
}
|
|
struct svc_export *rqst_exp_find(struct cache_req *reqp, struct net *net,
|
|
struct auth_domain *cl, struct auth_domain *gsscl,
|
|
int fsid_type, u32 *fsidv);
|
|
|
|
#endif /* NFSD_EXPORT_H */
|