| Message ID | 66b0ff35-c468-1a5b-3327-7e2ffcc768ee@I-love.SAKURA.ne.jp (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | NFSD: unregister shrinker when nfsd_init_net() fails | expand |
On Mon, 2022-10-10 at 14:59 +0900, Tetsuo Handa wrote: > syzbot is reporting UAF read at register_shrinker_prepared() [1], for > commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on > low memory condition") missed that nfsd4_leases_net_shutdown() from > nfsd_exit_net() is called only when nfsd_init_net() succeeded. > If nfsd_init_net() fails due to nfsd_reply_cache_init() failure, > register_shrinker() from nfsd4_init_leases_net() has to be undone > before nfsd_init_net() returns. > > Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89 [1] > Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition") > --- > fs/nfsd/nfsctl.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > index 6a29bcfc9390..dc74a947a440 100644 > --- a/fs/nfsd/nfsctl.c > +++ b/fs/nfsd/nfsctl.c > @@ -1458,12 +1458,14 @@ static __net_init int nfsd_init_net(struct net *net) > goto out_drc_error; > retval = nfsd_reply_cache_init(nn); > if (retval) > - goto out_drc_error; > + goto out_cache_error; > get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key)); > seqlock_init(&nn->writeverf_lock); > > return 0; > > +out_cache_error: > + nfsd4_leases_net_shutdown(nn); > out_drc_error: > nfsd_idmap_shutdown(net); > out_idmap_error: Good catch! Reviewed-by: Jeff Layton <jlayton@kernel.org>
> On Oct 10, 2022, at 1:59 AM, Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> wrote: > > syzbot is reporting UAF read at register_shrinker_prepared() [1], for > commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on > low memory condition") missed that nfsd4_leases_net_shutdown() from > nfsd_exit_net() is called only when nfsd_init_net() succeeded. > If nfsd_init_net() fails due to nfsd_reply_cache_init() failure, > register_shrinker() from nfsd4_init_leases_net() has to be undone > before nfsd_init_net() returns. > > Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89 [1] > Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition") I've applied this to nfsd's for-rc branch: https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/log/?h=for-rc Thanks! > --- > fs/nfsd/nfsctl.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > index 6a29bcfc9390..dc74a947a440 100644 > --- a/fs/nfsd/nfsctl.c > +++ b/fs/nfsd/nfsctl.c > @@ -1458,12 +1458,14 @@ static __net_init int nfsd_init_net(struct net *net) > goto out_drc_error; > retval = nfsd_reply_cache_init(nn); > if (retval) > - goto out_drc_error; > + goto out_cache_error; > get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key)); > seqlock_init(&nn->writeverf_lock); > > return 0; > > +out_cache_error: > + nfsd4_leases_net_shutdown(nn); > out_drc_error: > nfsd_idmap_shutdown(net); > out_idmap_error: > -- > 2.34.1 > > -- Chuck Lever
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 6a29bcfc9390..dc74a947a440 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1458,12 +1458,14 @@ static __net_init int nfsd_init_net(struct net *net) goto out_drc_error; retval = nfsd_reply_cache_init(nn); if (retval) - goto out_drc_error; + goto out_cache_error; get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key)); seqlock_init(&nn->writeverf_lock); return 0; +out_cache_error: + nfsd4_leases_net_shutdown(nn); out_drc_error: nfsd_idmap_shutdown(net); out_idmap_error:
syzbot is reporting UAF read at register_shrinker_prepared() [1], for commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition") missed that nfsd4_leases_net_shutdown() from nfsd_exit_net() is called only when nfsd_init_net() succeeded. If nfsd_init_net() fails due to nfsd_reply_cache_init() failure, register_shrinker() from nfsd4_init_leases_net() has to be undone before nfsd_init_net() returns. Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89 [1] Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition") --- fs/nfsd/nfsctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)