| Message ID | 20200820193951.GA28555@fieldses.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | nfsd: fix oops on mixed NFSv4/NFSv3 client access | expand |
> On Aug 20, 2020, at 3:39 PM, Bruce Fields <bfields@fieldses.org> wrote: > > From: "J. Bruce Fields" <bfields@redhat.com> > > If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a > NULL dereference in nfsd_breaker_owns_lease(). > > Easily reproduceable with for example > > mount -overs=4.2 server:/export /mnt/ > sleep 1h </mnt/file & > mount -overs=3 server:/export /mnt2/ > touch /mnt2/file > > Reported-by: Robert Dinse <nanook@eskimo.com> > Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own delegations") > Signed-off-by: J. Bruce Fields <bfields@redhat.com> I think I've got this queued already. Is this different than: http://git.linux-nfs.org/?p=cel/cel-2.6.git;a=commit;h=34b09af4f54e6485e28f138ccad159611a240cc1 > --- > fs/nfsd/nfs4state.c | 2 ++ > 1 file changed, 2 insertions(+) > > Oops, I've had this sitting around a couple weeks but I must have > forgotten to send it in. This is needed for 5.9. > > diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c > index 4b70657385f2..0e5302f6df52 100644 > --- a/fs/nfsd/nfs4state.c > +++ b/fs/nfsd/nfs4state.c > @@ -4598,6 +4598,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) > if (!i_am_nfsd()) > return NULL; > rqst = kthread_data(current); > + if (!rqst->rq_lease_breaker) > + return NULL; > clp = *(rqst->rq_lease_breaker); > return dl->dl_stid.sc_client == clp; > } > -- > 2.26.2 > -- Chuck Lever
On Thu, Aug 20, 2020 at 03:42:14PM -0400, Chuck Lever wrote: > > > > On Aug 20, 2020, at 3:39 PM, Bruce Fields <bfields@fieldses.org> wrote: > > > > From: "J. Bruce Fields" <bfields@redhat.com> > > > > If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a > > NULL dereference in nfsd_breaker_owns_lease(). > > > > Easily reproduceable with for example > > > > mount -overs=4.2 server:/export /mnt/ > > sleep 1h </mnt/file & > > mount -overs=3 server:/export /mnt2/ > > touch /mnt2/file > > > > Reported-by: Robert Dinse <nanook@eskimo.com> > > Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own delegations") > > Signed-off-by: J. Bruce Fields <bfields@redhat.com> > > I think I've got this queued already. Is this different than: > > http://git.linux-nfs.org/?p=cel/cel-2.6.git;a=commit;h=34b09af4f54e6485e28f138ccad159611a240cc1 Oh, OK, great.--b. > > > > --- > > fs/nfsd/nfs4state.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > Oops, I've had this sitting around a couple weeks but I must have > > forgotten to send it in. This is needed for 5.9. > > > > diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c > > index 4b70657385f2..0e5302f6df52 100644 > > --- a/fs/nfsd/nfs4state.c > > +++ b/fs/nfsd/nfs4state.c > > @@ -4598,6 +4598,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) > > if (!i_am_nfsd()) > > return NULL; > > rqst = kthread_data(current); > > + if (!rqst->rq_lease_breaker) > > + return NULL; > > clp = *(rqst->rq_lease_breaker); > > return dl->dl_stid.sc_client == clp; > > } > > -- > > 2.26.2 > > > > -- > Chuck Lever > >
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 4b70657385f2..0e5302f6df52 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -4598,6 +4598,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) if (!i_am_nfsd()) return NULL; rqst = kthread_data(current); + if (!rqst->rq_lease_breaker) + return NULL; clp = *(rqst->rq_lease_breaker); return dl->dl_stid.sc_client == clp; }