From: "bfields@fieldses.org" <bfields@fieldses.org>
To: Vasily Averin <vvs@virtuozzo.com>
Cc: Trond Myklebust <trondmy@hammerspace.com>,
"anna.schumaker@netapp.com" <anna.schumaker@netapp.com>,
"khorenko@virtuozzo.com" <khorenko@virtuozzo.com>,
"linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>,
"eshatokhin@virtuozzo.com" <eshatokhin@virtuozzo.com>,
"chuck.lever@oracle.com" <chuck.lever@oracle.com>,
"jlayton@kernel.org" <jlayton@kernel.org>
Subject: Re: [PATCH 1/4] nfs: use-after-free in svc_process_common()
Date: Sun, 23 Dec 2018 15:52:52 -0500 [thread overview]
Message-ID: <20181223205252.GA2613@fieldses.org> (raw)
In-Reply-To: <9082b04a-8235-4b9d-39ae-1462fe350935@virtuozzo.com>
On Sat, Dec 22, 2018 at 08:46:55PM +0300, Vasily Averin wrote:
> On 12/21/18 4:00 AM, bfields@fieldses.org wrote:
> > On Tue, Dec 18, 2018 at 02:55:15PM +0000, Trond Myklebust wrote:
> >> No. We don't care about xpt_flags for the back channel because there is
> >> no "server transport". The actual transport is stored in the 'struct
> >> rpc_rqst', and is the struct rpc_xprt corresponding to the client
> >> socket or RDMA channel.
> >>
> >> IOW: All we really need in svc_process_common() is to be able to run
> >> rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(), and that can be passed
> >> either as a pointer to the struct svc_xprt_ops itself.
> >
> > For what it's worth, I'd rather get rid of that op--it's an awfully
> > roundabout way just to do "svc_putnl(resv, 0);" in the tcp case.
>
> Do you mean that svc_create_xprt(serv, "tcp-bc", ...) was used ONLY to call
> svc_tcp_prep_reply_hdr() in svc_process_common() ?
> And according call for rdma-bc does nothing useful at all?
Right, in the rdma case it's:
void svc_rdma_prep_reply_hdr(struct svc_rqst *rqstp)
{
}
> I've just tried to remove svc_create_xprt() from xs_tcp_bc_up() and
> just provide pointer to svc_tcp_prep_reply_hdr() in
> svc_process_common() via per-netns sunrpc_net -- and seems it was
> enough, my testcase worked correctly.
>
> Am I missed something probably? Should we really remove
> svc_create_xprt( "tcp/rdma-bc"...) related stuff? ?
Haven't looked carefully, but off the top of my head I can't see why
that wouldn't work.
I also tried some patches that replace that op by a flag bit (doesn't
address the original problem here, just seemed like a simplification):
git://linux-nfs.org/~bfields/linux-topics.git
but I don't if that's compatible with what you've done.
--b.
next prev parent reply other threads:[~2018-12-23 20:52 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-17 16:23 [PATCH 1/4] nfs: use-after-free in svc_process_common() Vasily Averin
2018-12-17 17:49 ` Jeff Layton
2018-12-17 21:50 ` J. Bruce Fields
2018-12-18 6:45 ` Vasily Averin
2018-12-18 12:49 ` Trond Myklebust
2018-12-18 14:35 ` Vasily Averin
2018-12-18 14:55 ` Trond Myklebust
2018-12-18 20:02 ` Vasily Averin
2018-12-18 20:43 ` Trond Myklebust
2018-12-19 11:25 ` Vasily Averin
2018-12-20 1:39 ` Vasily Averin
2018-12-20 1:58 ` Trond Myklebust
2018-12-20 9:30 ` Vasily Averin
2018-12-20 11:58 ` Trond Myklebust
2018-12-21 1:00 ` bfields
2018-12-21 11:30 ` Vasily Averin
2018-12-21 17:39 ` Vasily Averin
2018-12-22 17:46 ` Vasily Averin
2018-12-23 20:52 ` bfields [this message]
2018-12-23 21:03 ` Vasily Averin
2018-12-23 23:56 ` Trond Myklebust
2018-12-24 5:51 ` Vasily Averin
2018-12-24 6:05 ` Vasily Averin
2018-12-24 8:21 ` Trond Myklebust
2018-12-24 8:59 ` Vasily Averin
2018-12-24 9:53 ` Trond Myklebust
2018-12-24 11:48 ` Vasily Averin
2018-12-18 21:31 ` Vladis Dronov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181223205252.GA2613@fieldses.org \
--to=bfields@fieldses.org \
--cc=anna.schumaker@netapp.com \
--cc=chuck.lever@oracle.com \
--cc=eshatokhin@virtuozzo.com \
--cc=jlayton@kernel.org \
--cc=khorenko@virtuozzo.com \
--cc=linux-nfs@vger.kernel.org \
--cc=trondmy@hammerspace.com \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).