* [v2 0/2] Fix null-ptr-deref in nfsd_fill_super()
@ 2022-05-21 4:08 Zhang Xiaoxu
2022-05-21 4:08 ` [v2 1/2] nfsd: Unregister the cld notifier when laundry_wq create failed Zhang Xiaoxu
2022-05-21 4:08 ` [v2 2/2] nfsd: Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
0 siblings, 2 replies; 3+ messages in thread
From: Zhang Xiaoxu @ 2022-05-21 4:08 UTC (permalink / raw)
To: zhangxiaoxu5, bfields, chuck.lever, linux-nfs, yi.zhang,
luomeng12, dai.ngo
Also do some clean up in init_nfsd().
Since there are much difference with the linux master branch,
@Bruce could you help to review this patch again.
Zhang Xiaoxu (2):
nfsd: Unregister the cld notifier when laundry_wq create failed
nfsd: Fix null-ptr-deref in nfsd_fill_super()
fs/nfsd/nfsctl.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--
2.31.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [v2 1/2] nfsd: Unregister the cld notifier when laundry_wq create failed
2022-05-21 4:08 [v2 0/2] Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
@ 2022-05-21 4:08 ` Zhang Xiaoxu
2022-05-21 4:08 ` [v2 2/2] nfsd: Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
1 sibling, 0 replies; 3+ messages in thread
From: Zhang Xiaoxu @ 2022-05-21 4:08 UTC (permalink / raw)
To: zhangxiaoxu5, bfields, chuck.lever, linux-nfs, yi.zhang,
luomeng12, dai.ngo
If laundry_wq create failed, the cld notifier should be unregistered.
Fixes: d76cc46b37e1 ("NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd")
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
---
fs/nfsd/nfsctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 322a208878f2..55949e60897d 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1543,12 +1543,14 @@ static int __init init_nfsd(void)
goto out_free_filesystem;
retval = register_cld_notifier();
if (retval)
- goto out_free_all;
+ goto out_free_subsys;
retval = nfsd4_create_laundry_wq();
if (retval)
goto out_free_all;
return 0;
out_free_all:
+ unregister_cld_notifier();
+out_free_subsys:
unregister_pernet_subsys(&nfsd_net_ops);
out_free_filesystem:
unregister_filesystem(&nfsd_fs_type);
--
2.31.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [v2 2/2] nfsd: Fix null-ptr-deref in nfsd_fill_super()
2022-05-21 4:08 [v2 0/2] Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
2022-05-21 4:08 ` [v2 1/2] nfsd: Unregister the cld notifier when laundry_wq create failed Zhang Xiaoxu
@ 2022-05-21 4:08 ` Zhang Xiaoxu
1 sibling, 0 replies; 3+ messages in thread
From: Zhang Xiaoxu @ 2022-05-21 4:08 UTC (permalink / raw)
To: zhangxiaoxu5, bfields, chuck.lever, linux-nfs, yi.zhang,
luomeng12, dai.ngo
KASAN report null-ptr-deref as follows:
BUG: KASAN: null-ptr-deref in nfsd_fill_super+0xc6/0xe0 [nfsd]
Write of size 8 at addr 000000000000005d by task a.out/852
CPU: 7 PID: 852 Comm: a.out Not tainted 5.18.0-rc7-dirty #66
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
kasan_report+0xab/0x120
? nfsd_mkdir+0x71/0x1c0 [nfsd]
? nfsd_fill_super+0xc6/0xe0 [nfsd]
nfsd_fill_super+0xc6/0xe0 [nfsd]
? nfsd_mkdir+0x1c0/0x1c0 [nfsd]
get_tree_keyed+0x8e/0x100
vfs_get_tree+0x41/0xf0
__do_sys_fsconfig+0x590/0x670
? fscontext_read+0x180/0x180
? anon_inode_getfd+0x4f/0x70
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
This can be reproduce by concurrent operations:
1. fsopen(nfsd)/fsconfig
2. insmod/rmmod nfsd
Since the nfsd file system is registered before than nfsd_net allocated,
the caller may get the file_system_type and use the nfsd_net before it
allocated, then null-ptr-deref occurred.
So init_nfsd() should call register_filesystem() last.
Fixes: bd5ae9288d64 ("nfsd: register pernet ops last, unregister first")
Cc: stable@kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
---
fs/nfsd/nfsctl.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 55949e60897d..0621c2faf242 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1535,25 +1535,25 @@ static int __init init_nfsd(void)
retval = create_proc_exports_entry();
if (retval)
goto out_free_lockd;
- retval = register_filesystem(&nfsd_fs_type);
- if (retval)
- goto out_free_exports;
retval = register_pernet_subsys(&nfsd_net_ops);
if (retval < 0)
- goto out_free_filesystem;
+ goto out_free_exports;
retval = register_cld_notifier();
if (retval)
goto out_free_subsys;
retval = nfsd4_create_laundry_wq();
+ if (retval)
+ goto out_free_cld;
+ retval = register_filesystem(&nfsd_fs_type);
if (retval)
goto out_free_all;
return 0;
out_free_all:
+ nfsd4_destroy_laundry_wq();
+out_free_cld:
unregister_cld_notifier();
out_free_subsys:
unregister_pernet_subsys(&nfsd_net_ops);
-out_free_filesystem:
- unregister_filesystem(&nfsd_fs_type);
out_free_exports:
remove_proc_entry("fs/nfs/exports", NULL);
remove_proc_entry("fs/nfs", NULL);
@@ -1571,6 +1571,7 @@ static int __init init_nfsd(void)
static void __exit exit_nfsd(void)
{
+ unregister_filesystem(&nfsd_fs_type);
nfsd4_destroy_laundry_wq();
unregister_cld_notifier();
unregister_pernet_subsys(&nfsd_net_ops);
@@ -1581,7 +1582,6 @@ static void __exit exit_nfsd(void)
nfsd_lockd_shutdown();
nfsd4_free_slabs();
nfsd4_exit_pnfs();
- unregister_filesystem(&nfsd_fs_type);
}
MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
--
2.31.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-21 3:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-21 4:08 [v2 0/2] Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
2022-05-21 4:08 ` [v2 1/2] nfsd: Unregister the cld notifier when laundry_wq create failed Zhang Xiaoxu
2022-05-21 4:08 ` [v2 2/2] nfsd: Fix null-ptr-deref in nfsd_fill_super() Zhang Xiaoxu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.