NFSD: Defer sub-object cleanup in export put callbacks

svc_export_put() calls path_put() and auth_domain_put() immediately
when the last reference drops, before the RCU grace period. RCU
readers in e_show() and c_show() access both ex_path (via
seq_path/d_path) and ex_client->name (via seq_escape) without
holding a reference. If cache_clean removes the entry and drops the
last reference concurrently, the sub-objects are freed while still
in use, producing a NULL pointer dereference in d_path.

Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or
ex_stats") moved kfree of ex_uuid and ex_stats into the
call_rcu callback, but left path_put() and auth_domain_put() running
before the grace period because both may sleep and call_rcu
callbacks execute in softirq context.

Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the
callback until after the RCU grace period and executes it in process
context where sleeping is permitted. This allows path_put() and
auth_domain_put() to be moved into the deferred callback alongside
the other resource releases. Apply the same fix to expkey_put(),
which has the identical pattern with ek_path and ek_client.

A dedicated workqueue scopes the shutdown drain to only NFSD
export release work items; flushing the shared
system_unbound_wq would stall on unrelated work from other
subsystems. nfsd_export_shutdown() uses rcu_barrier() followed
by flush_workqueue() to ensure all deferred release callbacks
complete before the export caches are destroyed.

Reported-by: Misbah Anjum N <misanjum@linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/
Fixes: c224edca7af0 ("nfsd: no need get cache ref when protected by rcu")
Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu")
Cc: stable@vger.kernel.org
Reviwed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Tested-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 2a1499f2ad196a6033787260881e451146283bdc..18933ca407befd9d6db0446ef1e62627d13a6d27 100644 (file)
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -36,19 +36,30 @@
  * second map contains a reference to the entry in the first map.
  */
 
+static struct workqueue_struct *nfsd_export_wq;
+
 #define        EXPKEY_HASHBITS         8
 #define        EXPKEY_HASHMAX          (1 << EXPKEY_HASHBITS)
 #define        EXPKEY_HASHMASK         (EXPKEY_HASHMAX -1)
 
-static void expkey_put(struct kref *ref)
+static void expkey_release(struct work_struct *work)
 {
-       struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+       struct svc_expkey *key = container_of(to_rcu_work(work),
+                                             struct svc_expkey, ek_rwork);
 
        if (test_bit(CACHE_VALID, &key->h.flags) &&
            !test_bit(CACHE_NEGATIVE, &key->h.flags))
                path_put(&key->ek_path);
        auth_domain_put(key->ek_client);
-       kfree_rcu(key, ek_rcu);
+       kfree(key);
+}
+
+static void expkey_put(struct kref *ref)
+{
+       struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+
+       INIT_RCU_WORK(&key->ek_rwork, expkey_release);
+       queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
 }
 
 static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -353,11 +364,13 @@ static void export_stats_destroy(struct export_stats *stats)
                                            EXP_STATS_COUNTERS_NUM);
 }
 
-static void svc_export_release(struct rcu_head *rcu_head)
+static void svc_export_release(struct work_struct *work)
 {
-       struct svc_export *exp = container_of(rcu_head, struct svc_export,
-                       ex_rcu);
+       struct svc_export *exp = container_of(to_rcu_work(work),
+                                             struct svc_export, ex_rwork);
 
+       path_put(&exp->ex_path);
+       auth_domain_put(exp->ex_client);
        nfsd4_fslocs_free(&exp->ex_fslocs);
        export_stats_destroy(exp->ex_stats);
        kfree(exp->ex_stats);
@@ -369,9 +382,8 @@ static void svc_export_put(struct kref *ref)
 {
        struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
 
-       path_put(&exp->ex_path);
-       auth_domain_put(exp->ex_client);
-       call_rcu(&exp->ex_rcu, svc_export_release);
+       INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
+       queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
 }
 
 static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
@@ -1478,6 +1490,36 @@ const struct seq_operations nfs_exports_op = {
        .show   = e_show,
 };
 
+/**
+ * nfsd_export_wq_init - allocate the export release workqueue
+ *
+ * Called once at module load. The workqueue runs deferred svc_export and
+ * svc_expkey release work scheduled by queue_rcu_work() in the cache put
+ * callbacks.
+ *
+ * Return values:
+ *   %0: workqueue allocated
+ *   %-ENOMEM: allocation failed
+ */
+int nfsd_export_wq_init(void)
+{
+       nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
+       if (!nfsd_export_wq)
+               return -ENOMEM;
+       return 0;
+}
+
+/**
+ * nfsd_export_wq_shutdown - drain and free the export release workqueue
+ *
+ * Called once at module unload. Per-namespace teardown in
+ * nfsd_export_shutdown() has already drained all deferred work.
+ */
+void nfsd_export_wq_shutdown(void)
+{
+       destroy_workqueue(nfsd_export_wq);
+}
+
 /*
  * Initialize the exports module.
  */
@@ -1539,6 +1581,9 @@ nfsd_export_shutdown(struct net *net)
 
        cache_unregister_net(nn->svc_expkey_cache, net);
        cache_unregister_net(nn->svc_export_cache, net);
+       /* Drain deferred export and expkey release work. */
+       rcu_barrier();
+       flush_workqueue(nfsd_export_wq);
        cache_destroy_net(nn->svc_expkey_cache, net);
        cache_destroy_net(nn->svc_export_cache, net);
        svcauth_unix_purge(net);

diff --git a/fs/nfsd/export.h b/fs/nfsd/export.h
index d2b09cd761453dd3892344d27793b7033322319f..b053993745749e0a00d806ace7d019505fe9c121 100644 (file)
--- a/fs/nfsd/export.h
+++ b/fs/nfsd/export.h
@@ -7,6 +7,7 @@
 
 #include <linux/sunrpc/cache.h>
 #include <linux/percpu_counter.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/nfsd/export.h>
 #include <linux/nfs4.h>
 
@@ -75,7 +76,7 @@ struct svc_export {
        u32                     ex_layout_types;
        struct nfsd4_deviceid_map *ex_devid_map;
        struct cache_detail     *cd;
-       struct rcu_head         ex_rcu;
+       struct rcu_work         ex_rwork;
        unsigned long           ex_xprtsec_modes;
        struct export_stats     *ex_stats;
 };
@@ -92,7 +93,7 @@ struct svc_expkey {
        u32                     ek_fsid[6];
 
        struct path             ek_path;
-       struct rcu_head         ek_rcu;
+       struct rcu_work         ek_rwork;
 };
 
 #define EX_ISSYNC(exp)         (!((exp)->ex_flags & NFSEXP_ASYNC))
@@ -110,6 +111,8 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp,
 /*
  * Function declarations
  */
+int                    nfsd_export_wq_init(void);
+void                   nfsd_export_wq_shutdown(void);
 int                    nfsd_export_init(struct net *);
 void                   nfsd_export_shutdown(struct net *);
 void                   nfsd_export_flush(struct net *);

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 369da69d5efeba8bfca043f7f47d11a1353279af..fe3b3f206aa9ef4215f2ca5771b3f8a108795e92 100644 (file)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -2259,9 +2259,12 @@ static int __init init_nfsd(void)
        if (retval)
                goto out_free_pnfs;
        nfsd_lockd_init();      /* lockd->nfsd callbacks */
+       retval = nfsd_export_wq_init();
+       if (retval)
+               goto out_free_lockd;
        retval = register_pernet_subsys(&nfsd_net_ops);
        if (retval < 0)
-               goto out_free_lockd;
+               goto out_free_export_wq;
        retval = register_cld_notifier();
        if (retval)
                goto out_free_subsys;
@@ -2290,6 +2293,8 @@ out_free_cld:
        unregister_cld_notifier();
 out_free_subsys:
        unregister_pernet_subsys(&nfsd_net_ops);
+out_free_export_wq:
+       nfsd_export_wq_shutdown();
 out_free_lockd:
        nfsd_lockd_shutdown();
        nfsd_drc_slab_free();
@@ -2310,6 +2315,7 @@ static void __exit exit_nfsd(void)
        nfsd4_destroy_laundry_wq();
        unregister_cld_notifier();
        unregister_pernet_subsys(&nfsd_net_ops);
+       nfsd_export_wq_shutdown();
        nfsd_drc_slab_free();
        nfsd_lockd_shutdown();
        nfsd4_free_slabs();