Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <80e1506f0a997f1f925990fe12c4469947b7b184.camel@kernel.org>
Subject: Re: [PATCH v2] nfsd: memory corruption in nfsd4_lock()
From:   Jeff Layton <jlayton@kernel.org>
To:     Vasily Averin <vvs@virtuozzo.com>,
        "J. Bruce Fields" <bfields@redhat.com>,
        Chuck Lever <chuck.lever@oracle.com>
Cc:     linux-nfs@vger.kernel.org
Date:   Mon, 30 Mar 2020 06:22:46 -0400
In-Reply-To: <d169e942-03e4-0a4b-8c45-56f4c26cd45c@virtuozzo.com>
References: <7E365A05-4D39-4BF9-8E44-244136173FC7@oracle.com>
         <d169e942-03e4-0a4b-8c45-56f4c26cd45c@virtuozzo.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.34.4 (3.34.4-1.fc31) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

On Fri, 2020-03-27 at 07:50 +0300, Vasily Averin wrote:
> Dear Chuck,
> please use following patch instead.
> -----
> New struct nfsd4_blocked_lock allocated in find_or_allocate_block()
> does not initialized nbl_list and nbl_lru.
> If conflock allocation fails rollback can call list_del_init()
> access uninitialized fields and corrupt memory.
> 
> v2: just initialize nbl_list and nbl_lru right after nbl allocation.
> 
> Fixes: 76d348fadff5 ("nfsd: have nfsd4_lock use blocking locks for v4.1+ lock")
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>  fs/nfsd/nfs4state.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index 369e574c5092..1b2eb6b35d64 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -266,6 +266,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
>  	if (!nbl) {
>  		nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
>  		if (nbl) {
> +			INIT_LIST_HEAD(&nbl->nbl_list);
> +			INIT_LIST_HEAD(&nbl->nbl_lru);
>  			fh_copy_shallow(&nbl->nbl_fh, fh);
>  			locks_init_lock(&nbl->nbl_lock);
>  			nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,

Reviewed-by: Jeff Layton <jlayton@kernel.org>