From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C8ABC41517 for ; Wed, 24 Jul 2019 20:25:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 29A0E214AF for ; Wed, 24 Jul 2019 20:25:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563999918; bh=EEMkZdrmz4xgZdJjlrYw+g+ONXr9nSokfarp7hTEMpE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=o3zTBGcABUob7e0eO/dYkalpBxq1EdtLp5peTHyqo1IqRfcttViumLuKJAEPx4FCm PkuQinOeqpR3A+DfcnXPKKF6QJ97FVgatjDKD8zcgI/o6Fa6n5TSqH3FH9g2paYRnY 7b4PeVTsXbhuN+wwZXTs8SQKDdzDDCvf1avm01Mc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389650AbfGXTji (ORCPT ); Wed, 24 Jul 2019 15:39:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:40634 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389500AbfGXTjd (ORCPT ); Wed, 24 Jul 2019 15:39:33 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3EB1322ADA; Wed, 24 Jul 2019 19:39:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563997172; bh=EEMkZdrmz4xgZdJjlrYw+g+ONXr9nSokfarp7hTEMpE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ty/5QZgKLH+6G/R63zmDhY/RzMVO2jcOlmklo6m1Bu1TInBqw/9ojlW5/6fRWPld9 Qa0dskt8knQV6tOFIyMeahJOw6ddamJz9eCq/PGJSMxyaSNz2ZTzFtK8bKJjJt4SIE eTraR8/HZM5emAFgNzec3QqtqXgL858g5jxWvffA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Trond Myklebust Subject: [PATCH 5.2 304/413] NFSv4: Handle the special Linux file open access mode Date: Wed, 24 Jul 2019 21:19:55 +0200 Message-Id: <20190724191757.597829473@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190724191735.096702571@linuxfoundation.org> References: <20190724191735.096702571@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Trond Myklebust commit 44942b4e457beda00981f616402a1a791e8c616e upstream. According to the open() manpage, Linux reserves the access mode 3 to mean "check for read and write permission on the file and return a file descriptor that can't be used for reading or writing." Currently, the NFSv4 code will ask the server to open the file, and will use an incorrect share access mode of 0. Since it has an incorrect share access mode, the client later forgets to send a corresponding close, meaning it can leak stateids on the server. Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations") Cc: stable@vger.kernel.org # 3.6+ Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman --- fs/nfs/inode.c | 1 + fs/nfs/nfs4file.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1100,6 +1100,7 @@ int nfs_open(struct inode *inode, struct nfs_fscache_open_file(inode, filp); return 0; } +EXPORT_SYMBOL_GPL(nfs_open); /* * This function is called whenever some part of NFS notices that --- a/fs/nfs/nfs4file.c +++ b/fs/nfs/nfs4file.c @@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, stru return err; if ((openflags & O_ACCMODE) == 3) - openflags--; + return nfs_open(inode, filp); /* We can't create new files here */ openflags &= ~(O_CREAT|O_EXCL);