github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfs4: take a reference on the nfs_client when running FREE_STATEID

Browse Source 
During umount, the session slot tables are freed.  If there are
outstanding FREE_STATEID tasks, a use-after-free and slab corruption can
occur when rpc_exit_task calls rpc_call_done -> nfs41_sequence_done ->
nfs4_sequence_process/nfs41_sequence_free_slot.

Prevent that from happening by taking a reference on the nfs_client in
nfs41_free_stateid and putting it in nfs41_free_stateid_release.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
Scott Mayhew 2021-11-03 06:24:40 -04:00 committed by Trond Myklebust
parent edfa0b16bf
commit 576acc2591
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/nfs/nfs4proc.c
View File

@ -10115,6 +10115,10 @@ static void nfs41_free_stateid_done(struct rpc_task *task, void *calldata)
static void nfs41_free_stateid_release(void *calldata) static void nfs41_free_stateid_release(void *calldata)
{ {
struct nfs_free_stateid_data *data = calldata;
struct nfs_client *clp = data->server->nfs_client;
nfs_put_client(clp);
kfree(calldata); kfree(calldata);
} }
@ -10151,6 +10155,10 @@ static int nfs41_free_stateid(struct nfs_server *server,
}; };
struct nfs_free_stateid_data *data; struct nfs_free_stateid_data *data;
struct rpc_task *task; struct rpc_task *task;
struct nfs_client *clp = server->nfs_client;
if (!refcount_inc_not_zero(&clp->cl_count))
return -EIO;
nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_STATEID, nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_STATEID,
&task_setup.rpc_client, &msg); &task_setup.rpc_client, &msg);