From patchwork Fri Jan 12 22:42:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Trond Myklebust X-Patchwork-Id: 10161837 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 44C2B60327 for ; Fri, 12 Jan 2018 22:42:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3681A28ACD for ; Fri, 12 Jan 2018 22:42:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2B24C28AE7; Fri, 12 Jan 2018 22:42:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9684028ACD for ; Fri, 12 Jan 2018 22:42:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965273AbeALWmf (ORCPT ); Fri, 12 Jan 2018 17:42:35 -0500 Received: from mail-io0-f193.google.com ([209.85.223.193]:39085 "EHLO mail-io0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965236AbeALWmf (ORCPT ); Fri, 12 Jan 2018 17:42:35 -0500 Received: by mail-io0-f193.google.com with SMTP id b198so4788929iof.6 for ; Fri, 12 Jan 2018 14:42:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=TkQbSh9iAIdENm5UF1UjDLxtmPlkKCy1GLEKzcRfDMg=; b=FSeBIwOP6JstIf88UuT/fFfWhjrEfRD0Xiy6qJGdGjcrf0eOz4Ws5dTgPpIL5bZfzp kWUtlT6fxs9ikQWm+mNMRKqHxRBVYB/wVSQ6d27yC/GApguncINZ445lgPEIq3bc5nbX XsHLEwofUMQiOlzKnUZmUl0xjwoFUlgO4JQAZJSqTobkpkcyNc7/3oDUCz0kAHhivSXU TSBG4WQ5L0eudi5qF2KegvoHhDEEqH65xu5KNYvzyHLsH5Jef0k+vIb2GaMtPsgES8SU 22kGoIUxN9+XBXs4QnuqUT+Vka7nJ4VOHVZz7H9IyBGxj4gXeeVtBXCXE3PtBgBEeGKI f1CQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :mime-version:content-transfer-encoding; bh=TkQbSh9iAIdENm5UF1UjDLxtmPlkKCy1GLEKzcRfDMg=; b=rTU10WrmkXbBLV2ZihsNsgp+aaTlXEpf6YPFmUF8lkELE0MY13B0+KeDEol0EfiHsT faJSf1bTT83PFz0ZDgq3MSDGOvkuX/I9BdtxO+uLRSggeWOha8eXJvDNnRVPh+81miUa SlDhGN0qWutMKiCbB2HYdmC0eovZuXaAi8SLPdbLvVtZZzeIq2MmOL1W8DvNfmpt7unH 5VGuuYmuABhK76UKwLNJmiIdWUBmnC/MWyzZvGovt5iaXYszFU08Bz+3fvI1n3vugR0u HwBiBhBPCSGX1nUaPgmmu3bKo0wdD4WKtV7zBACwpMsMjf7X7KExLXFpwf3k57EP7axv XzEQ== X-Gm-Message-State: AKwxytf65hHkVYNYEJfSxodrGYIgrHN6WHmLn0WQCnYZo+FxeoFlpygA l9o0Q2y8ct6DXtOVYM6+og== X-Google-Smtp-Source: ACJfBouAzPKKksSFzSl0+3K/AL75uuSpWTnmxMjTcJqRGEVpVgUezYJHbhNgj3Xk2jNFf23sjoXBzw== X-Received: by 10.107.131.219 with SMTP id n88mr5887464ioi.258.1515796954460; Fri, 12 Jan 2018 14:42:34 -0800 (PST) Received: from localhost.localdomain (c-68-49-162-121.hsd1.mi.comcast.net. [68.49.162.121]) by smtp.gmail.com with ESMTPSA id a140sm13412701ioe.85.2018.01.12.14.42.33 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 12 Jan 2018 14:42:33 -0800 (PST) From: Trond Myklebust To: Bruce Fields , Chuck Lever Cc: linux-nfs@vger.kernel.org Subject: [PATCH] nfsd: Detect unhashed stids in nfsd4_verify_open_stid() Date: Fri, 12 Jan 2018 17:42:30 -0500 Message-Id: <20180112224230.129322-1-trond.myklebust@primarydata.com> X-Mailer: git-send-email 2.14.3 MIME-Version: 1.0 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The state of the stid is guaranteed by 2 locks: - The nfs4_client 'cl_lock' spinlock - The nfs4_ol_stateid 'st_mutex' mutex so it is quite possible for the stid to be unhashed after lookup, but before calling nfsd4_lock_ol_stateid(). So we do need to check for a zero value for 'sc_type' in nfsd4_verify_open_stid(). Signed-off-by: Trond Myklebust Tested-by: Chuck Lever --- fs/nfsd/nfs4state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 8d53d29161f5..b5bda115f6a9 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -3591,6 +3591,7 @@ nfsd4_verify_open_stid(struct nfs4_stid *s) switch (s->sc_type) { default: break; + case 0: case NFS4_CLOSED_STID: case NFS4_CLOSED_DELEG_STID: ret = nfserr_bad_stateid;