From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vasily Averin <vvs@virtuozzo.com>,
Jeff Layton <jlayton@kernel.org>,
Chuck Lever <chuck.lever@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux-nfs@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 02/17] nfsd: memory corruption in nfsd4_lock()
Date: Thu, 30 Apr 2020 09:54:18 -0400 [thread overview]
Message-ID: <20200430135433.21204-2-sashal@kernel.org> (raw)
In-Reply-To: <20200430135433.21204-1-sashal@kernel.org>
From: Vasily Averin <vvs@virtuozzo.com>
[ Upstream commit e1e8399eee72e9d5246d4d1bcacd793debe34dd3 ]
New struct nfsd4_blocked_lock allocated in find_or_allocate_block()
does not initialized nbl_list and nbl_lru.
If conflock allocation fails rollback can call list_del_init()
access uninitialized fields and corrupt memory.
v2: just initialize nbl_list and nbl_lru right after nbl allocation.
Fixes: 76d348fadff5 ("nfsd: have nfsd4_lock use blocking locks for v4.1+ lock")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4state.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4509c76716e36..5c9231d5e14a0 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -246,6 +246,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
if (!nbl) {
nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
if (nbl) {
+ INIT_LIST_HEAD(&nbl->nbl_list);
+ INIT_LIST_HEAD(&nbl->nbl_lru);
fh_copy_shallow(&nbl->nbl_fh, fh);
locks_init_lock(&nbl->nbl_lock);
nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
--
2.20.1
next prev parent reply other threads:[~2020-04-30 13:58 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-30 13:54 [PATCH AUTOSEL 4.9 01/17] iio:ad7797: Use correct attribute_group Sasha Levin
2020-04-30 13:54 ` Sasha Levin [this message]
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 03/17] selftests/ipc: Fix test failure seen after initial test run Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 04/17] ASoC: sgtl5000: Fix VAG power-on handling Sasha Levin
2020-04-30 13:54 ` Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 05/17] wimax/i2400m: Fix potential urb refcnt leak Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 06/17] net: stmmac: Fix sub-second increment Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 07/17] team: fix hang in team_mode_get() Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 08/17] cifs: protect updating server->dstaddr with a spinlock Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 09/17] macvlan: fix null dereference in macvlan_device_event() Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 10/17] scripts/config: allow colons in option strings for sed Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 11/17] net: dsa: b53: Fix ARL register definitions Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 12/17] net: dsa: b53: Rework ARL bin logic Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 13/17] perf/core: fix parent pid/tid in task exit events Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 14/17] lib/mpi: Fix building for powerpc with clang Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 15/17] macsec: avoid to set wrong mtu Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 16/17] net: bcmgenet: suppress warnings on failed Rx SKB allocations Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.9 17/17] net: systemport: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200430135433.21204-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=chuck.lever@oracle.com \
--cc=jlayton@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.