SUNRPC: Fix potential memory corruption

[ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]

We really should not call rpc_wake_up_queued_task_set_status() with
xprt->snd_task as an argument unless we are certain that is actually an
rpc_task.

Fixes: 0445f92c5d53 ("SUNRPC: Fix disconnection races")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 61b622e334ee5fec2fc065efcb4e9c46002f6cf5..52e5b11e4b6a9f4cf6ca3f16062a3630122edab2 100644 (file)
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -422,6 +422,7 @@ void                        xprt_unlock_connect(struct rpc_xprt *, void *);
 #define XPRT_CONGESTED         (9)
 #define XPRT_CWND_WAIT         (10)
 #define XPRT_WRITE_SPACE       (11)
+#define XPRT_SND_IS_COOKIE     (12)
 
 static inline void xprt_set_connected(struct rpc_xprt *xprt)
 {

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 3509a7f139b98c6c11f91cdafd0d9d0c1c0a5dfe..19fa8616b8cf57f75a2e542f3c6b8d35aae2bc01 100644 (file)
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -774,9 +774,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)
        /* Try to schedule an autoclose RPC call */
        if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
                queue_work(xprtiod_workqueue, &xprt->task_cleanup);
-       else if (xprt->snd_task)
+       else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
                rpc_wake_up_queued_task_set_status(&xprt->pending,
-                               xprt->snd_task, -ENOTCONN);
+                                                  xprt->snd_task, -ENOTCONN);
        spin_unlock(&xprt->transport_lock);
 }
 EXPORT_SYMBOL_GPL(xprt_force_disconnect);
@@ -865,6 +865,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
                goto out;
        if (xprt->snd_task != task)
                goto out;
+       set_bit(XPRT_SND_IS_COOKIE, &xprt->state);
        xprt->snd_task = cookie;
        ret = true;
 out:
@@ -880,6 +881,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
        if (!test_bit(XPRT_LOCKED, &xprt->state))
                goto out;
        xprt->snd_task =NULL;
+       clear_bit(XPRT_SND_IS_COOKIE, &xprt->state);
        xprt->ops->release_xprt(xprt, NULL);
        xprt_schedule_autodisconnect(xprt);
 out: