| Message ID | 20200805191011.GB14429@fieldses.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | nfsd: fix oops on mixed NFSv4/NFSv3 client access | expand |
Hi Bruce- > On Aug 5, 2020, at 3:10 PM, bfields@fieldses.org wrote: > > From: "J. Bruce Fields" <bfields@redhat.com> > > If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a > NULL dereference in nfsd_breaker_owns_lease(). > > Easily reproduceable with for example > > mount -overs=4.2 server:/export /mnt/ > sleep 1h </mnt/file & > mount -overs=3 server:/export /mnt2/ > touch /mnt2/file > > Reported-by: Robert Dinse <nanook@eskimo.com> > Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own delegations") May I add BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208807 And send this in the first NFSD v5.9 -rc pull request? > Signed-off-by: J. Bruce Fields <bfields@redhat.com> > --- > fs/nfsd/nfs4state.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c > index 9fc0a1b9e4dd..45f3832d70d4 100644 > --- a/fs/nfsd/nfs4state.c > +++ b/fs/nfsd/nfs4state.c > @@ -4597,6 +4597,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) > if (!i_am_nfsd()) > return NULL; > rqst = kthread_data(current); > + if (!rqst->rq_lease_breaker) > + return NULL; > clp = *(rqst->rq_lease_breaker); > return dl->dl_stid.sc_client == clp; > } > -- > 2.26.2 > -- Chuck Lever
On Wed, Aug 05, 2020 at 03:17:54PM -0400, Chuck Lever wrote: > Hi Bruce- > > > On Aug 5, 2020, at 3:10 PM, bfields@fieldses.org wrote: > > > > From: "J. Bruce Fields" <bfields@redhat.com> > > > > If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a > > NULL dereference in nfsd_breaker_owns_lease(). > > > > Easily reproduceable with for example > > > > mount -overs=4.2 server:/export /mnt/ > > sleep 1h </mnt/file & > > mount -overs=3 server:/export /mnt2/ > > touch /mnt2/file > > > > Reported-by: Robert Dinse <nanook@eskimo.com> > > Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own delegations") > > May I add > > BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208807 > > And send this in the first NFSD v5.9 -rc pull request? Sounds good, thanks! --b. > > > > Signed-off-by: J. Bruce Fields <bfields@redhat.com> > > --- > > fs/nfsd/nfs4state.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c > > index 9fc0a1b9e4dd..45f3832d70d4 100644 > > --- a/fs/nfsd/nfs4state.c > > +++ b/fs/nfsd/nfs4state.c > > @@ -4597,6 +4597,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) > > if (!i_am_nfsd()) > > return NULL; > > rqst = kthread_data(current); > > + if (!rqst->rq_lease_breaker) > > + return NULL; > > clp = *(rqst->rq_lease_breaker); > > return dl->dl_stid.sc_client == clp; > > } > > -- > > 2.26.2 > > > > -- > Chuck Lever > >
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 9fc0a1b9e4dd..45f3832d70d4 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -4597,6 +4597,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) if (!i_am_nfsd()) return NULL; rqst = kthread_data(current); + if (!rqst->rq_lease_breaker) + return NULL; clp = *(rqst->rq_lease_breaker); return dl->dl_stid.sc_client == clp; }