Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Subject: Re: [PATCH v2] nfsd: memory corruption in nfsd4_lock()
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <80e1506f0a997f1f925990fe12c4469947b7b184.camel@kernel.org>
Date:   Mon, 30 Mar 2020 10:52:40 -0400
Cc:     Jeff Layton <jlayton@kernel.org>,
        Bruce Fields <bfields@redhat.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6BDFAB55-80A2-45D0-BC3B-CFB626AD2017@oracle.com>
References: <7E365A05-4D39-4BF9-8E44-244136173FC7@oracle.com>
 <d169e942-03e4-0a4b-8c45-56f4c26cd45c@virtuozzo.com>
 <80e1506f0a997f1f925990fe12c4469947b7b184.camel@kernel.org>
To:     Vasily Averin <vvs@virtuozzo.com>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


> On Mar 30, 2020, at 6:22 AM, Jeff Layton <jlayton@kernel.org> wrote:
>=20
> On Fri, 2020-03-27 at 07:50 +0300, Vasily Averin wrote:
>> Dear Chuck,
>> please use following patch instead.

Somehow this did not make it to my inbox on Friday, but Jeff's
Reviewed-by did show up today. I'll apply this one, thanks!


>> -----
>> New struct nfsd4_blocked_lock allocated in find_or_allocate_block()
>> does not initialized nbl_list and nbl_lru.
>> If conflock allocation fails rollback can call list_del_init()
>> access uninitialized fields and corrupt memory.
>>=20
>> v2: just initialize nbl_list and nbl_lru right after nbl allocation.
>>=20
>> Fixes: 76d348fadff5 ("nfsd: have nfsd4_lock use blocking locks for =
v4.1+ lock")
>> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
>> ---
>> fs/nfsd/nfs4state.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>=20
>> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
>> index 369e574c5092..1b2eb6b35d64 100644
>> --- a/fs/nfsd/nfs4state.c
>> +++ b/fs/nfsd/nfs4state.c
>> @@ -266,6 +266,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, =
struct knfsd_fh *fh,
>> 	if (!nbl) {
>> 		nbl=3D kmalloc(sizeof(*nbl), GFP_KERNEL);
>> 		if (nbl) {
>> +			INIT_LIST_HEAD(&nbl->nbl_list);
>> +			INIT_LIST_HEAD(&nbl->nbl_lru);
>> 			fh_copy_shallow(&nbl->nbl_fh, fh);
>> 			locks_init_lock(&nbl->nbl_lock);
>> 			nfsd4_init_cb(&nbl->nbl_cb, =
lo->lo_owner.so_client,
>=20
> Reviewed-by: Jeff Layton <jlayton@kernel.org>

--
Chuck Lever