From ede689d24d0ab42d4f997b8a19397bc29fa30e83 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 28 Mar 2023 16:13:13 +0200 Subject: [PATCH] 5.15-stable patches added patches: nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch --- ...x-use-after-free-in-__nfs42_ssc_open.patch | 90 +++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 91 insertions(+) create mode 100644 queue-5.15/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch diff --git a/queue-5.15/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch b/queue-5.15/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch new file mode 100644 index 00000000000..84f41bb1c0f --- /dev/null +++ b/queue-5.15/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch @@ -0,0 +1,90 @@ +From 75333d48f92256a0dec91dbf07835e804fc411c0 Mon Sep 17 00:00:00 2001 +From: Dai Ngo +Date: Mon, 12 Dec 2022 14:50:11 -0800 +Subject: NFSD: fix use-after-free in __nfs42_ssc_open() + +From: Dai Ngo + +commit 75333d48f92256a0dec91dbf07835e804fc411c0 upstream. + +Problem caused by source's vfsmount being unmounted but remains +on the delayed unmount list. This happens when nfs42_ssc_open() +return errors. + +Fixed by removing nfsd4_interssc_connect(), leave the vfsmount +for the laundromat to unmount when idle time expires. + +We don't need to call nfs_do_sb_deactive when nfs42_ssc_open +return errors since the file was not opened so nfs_server->active +was not incremented. Same as in nfsd4_copy, if we fail to +launch nfsd4_do_async_copy thread then there's no need to +call nfs_do_sb_deactive + +Reported-by: Xingyuan Mo +Signed-off-by: Dai Ngo +Tested-by: Xingyuan Mo +Signed-off-by: Chuck Lever +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4proc.c | 22 ++++++---------------- + 1 file changed, 6 insertions(+), 16 deletions(-) + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1351,13 +1351,6 @@ out_err: + return status; + } + +-static void +-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) +-{ +- nfs_do_sb_deactive(ss_mnt->mnt_sb); +- mntput(ss_mnt); +-} +- + /* + * Verify COPY destination stateid. + * +@@ -1460,11 +1453,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount + { + } + +-static void +-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) +-{ +-} +- + static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt, + struct nfs_fh *src_fh, + nfs4_stateid *stateid) +@@ -1622,14 +1610,14 @@ static int nfsd4_do_async_copy(void *dat + copy->nf_src = kzalloc(sizeof(struct nfsd_file), GFP_KERNEL); + if (!copy->nf_src) { + copy->nfserr = nfserr_serverfault; +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ss_mnt will be unmounted by the laundromat */ + goto do_callback; + } + copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, ©->c_fh, + ©->stateid); + if (IS_ERR(copy->nf_src->nf_file)) { + copy->nfserr = nfserr_offload_denied; +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ss_mnt will be unmounted by the laundromat */ + goto do_callback; + } + } +@@ -1714,8 +1702,10 @@ out_err: + if (async_copy) + cleanup_async_copy(async_copy); + status = nfserrno(-ENOMEM); +- if (!copy->cp_intra) +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ++ * source's vfsmount of inter-copy will be unmounted ++ * by the laundromat ++ */ + goto out; + } + diff --git a/queue-5.15/series b/queue-5.15/series index 9ccf5530aaa..537a76945fc 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -143,3 +143,4 @@ sched-fair-sanitize-vruntime-of-entity-being-placed.patch sched-fair-sanitize-vruntime-of-entity-being-migrated.patch mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object.patch ocfs2-fix-data-corruption-after-failed-write.patch +nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch -- 2.47.3