mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
fa670101d8
nlmsvc_grant_blocked() unlinks a block from nlm_blocked before it retries the lock, then re-inserts it. nlmsvc_traverse_blocks() skips a block that is not on nlm_blocked, so a teardown scan that runs during a retry passes it by and the retry puts it back. The surviving block pins its host. lockd warns that it could not shut down the host module, and the host outlives its network namespace. Hold the file's f_mutex across the retry, and extend the scan's hold across its unlink, so a scan and a retry of the same file can no longer interleave. Drop the mutex before releasing a block reference, since the last put takes f_mutex. A retry that waited out a scan re-checks under nlm_blocked_lock that its block is still queued and due. Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260819162247.2970703-1-cel@kernel.org?part=1 Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260822-lockd-retry-blocked-uaf-v3-2-761661eae60c@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org> |
||
|---|---|---|
| .. | ||
| clnt4xdr.c | ||
| clntlock.c | ||
| clntproc.c | ||
| clntxdr.c | ||
| host.c | ||
| lockd.h | ||
| Makefile | ||
| mon.c | ||
| netlink.c | ||
| netlink.h | ||
| netns.h | ||
| nlm.h | ||
| nlm3xdr_gen.c | ||
| nlm3xdr_gen.h | ||
| nlm4xdr_gen.c | ||
| nlm4xdr_gen.h | ||
| procfs.c | ||
| procfs.h | ||
| share.h | ||
| svc.c | ||
| svc4proc.c | ||
| svclock.c | ||
| svcproc.c | ||
| svcshare.c | ||
| svcsubs.c | ||
| trace.c | ||
| trace.h | ||
| xdr.h | ||