Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
Subject: Re: [PATCH] nfsd: fix oops on mixed NFSv4/NFSv3 client access
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <20200820193951.GA28555@fieldses.org>
Date:   Thu, 20 Aug 2020 15:42:14 -0400
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <1FECF29B-E908-4408-A70D-A876229BB0DB@oracle.com>
References: <20200820193951.GA28555@fieldses.org>
To:     Bruce Fields <bfields@fieldses.org>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


> On Aug 20, 2020, at 3:39 PM, Bruce Fields <bfields@fieldses.org> =
wrote:
>=20
> From: "J. Bruce Fields" <bfields@redhat.com>
>=20
> If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit =
a
> NULL dereference in nfsd_breaker_owns_lease().
>=20
> Easily reproduceable with for example
>=20
> 	mount -overs=3D4.2 server:/export /mnt/
> 	sleep 1h </mnt/file &
> 	mount -overs=3D3 server:/export /mnt2/
> 	touch /mnt2/file
>=20
> Reported-by: Robert Dinse <nanook@eskimo.com>
> Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own =
delegations")
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>

I think I've got this queued already. Is this different than:

=
http://git.linux-nfs.org/?p=3Dcel/cel-2.6.git;a=3Dcommit;h=3D34b09af4f54e6=
485e28f138ccad159611a240cc1


> ---
> fs/nfsd/nfs4state.c | 2 ++
> 1 file changed, 2 insertions(+)
>=20
> Oops, I've had this sitting around a couple weeks but I must have
> forgotten to send it in.  This is needed for 5.9.
>=20
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index 4b70657385f2..0e5302f6df52 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -4598,6 +4598,8 @@ static bool nfsd_breaker_owns_lease(struct =
file_lock *fl)
> 	if (!i_am_nfsd())
> 		return NULL;
> 	rqst =3D kthread_data(current);
> +	if (!rqst->rq_lease_breaker)
> +		return NULL;
> 	clp =3D *(rqst->rq_lease_breaker);
> 	return dl->dl_stid.sc_client =3D=3D clp;
> }
> --=20
> 2.26.2
>=20

--
Chuck Lever