Re: [PATCH] NFSD: unregister shrinker when nfsd_init_net() fails

[Jeff Layton <jlayton@kernel.org>]

On Mon, 2022-10-10 at 14:59 +0900, Tetsuo Handa wrote:
> syzbot is reporting UAF read at register_shrinker_prepared() [1], for
> commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on
> low memory condition") missed that nfsd4_leases_net_shutdown() from
> nfsd_exit_net() is called only when nfsd_init_net() succeeded.
> If nfsd_init_net() fails due to nfsd_reply_cache_init() failure,
> register_shrinker() from nfsd4_init_leases_net() has to be undone
> before nfsd_init_net() returns.
> 
> Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89 [1]
> Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition")
> ---
>  fs/nfsd/nfsctl.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 6a29bcfc9390..dc74a947a440 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -1458,12 +1458,14 @@ static __net_init int nfsd_init_net(struct net *net)
>  		goto out_drc_error;
>  	retval = nfsd_reply_cache_init(nn);
>  	if (retval)
> -		goto out_drc_error;
> +		goto out_cache_error;
>  	get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key));
>  	seqlock_init(&nn->writeverf_lock);
>  
>  	return 0;
>  
> +out_cache_error:
> +	nfsd4_leases_net_shutdown(nn);
>  out_drc_error:
>  	nfsd_idmap_shutdown(net);
>  out_idmap_error:


Good catch!

Reviewed-by: Jeff Layton <jlayton@kernel.org>