Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Jeff Layton <jlayton@kernel.org>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Neil Brown <neilb@suse.de>
Subject: Re: [PATCH v2] nfsd: nfsd_do_file_acquire should hold rcu_read_lock
 while getting refs
Thread-Topic: [PATCH v2] nfsd: nfsd_do_file_acquire should hold rcu_read_lock
 while getting refs
Thread-Index: AQHY1Xx83NLvB6RPo0qCB3ayozGSka35q3EAgAASgYCAAALTAA==
Date:   Sat, 1 Oct 2022 16:50:13 +0000
Message-ID: <3187452F-E577-4F95-B786-D83C1A8BFC37@oracle.com>
References: <20221001095918.7546-1-jlayton@kernel.org>
 <CD650F11-FFCE-46A3-90B8-45C742D8B670@oracle.com>
 <00076e31d59e95f97dc6d049aea9b2f41e54be54.camel@kernel.org>
In-Reply-To: <00076e31d59e95f97dc6d049aea9b2f41e54be54.camel@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?D7ZHHx2S7Gb/LI3Yl1/TNKh3HrjwLzTmpVP7i9bR4+V1+Fux8bjtSlwVrNRR?=
 =?us-ascii?Q?merEevlEZO3kj9tQZbRGxuQYRMYcaboZRSj06cvTDycdyrnZp+IvA9nvAfvs?=
 =?us-ascii?Q?EImAfpA06k/SiUekJ7V9LqE+/yCEKqyV8/AcXBmruTuuDWlQYWAHyEQCbDgB?=
 =?us-ascii?Q?MasekgOmJ/a4LxYeJ8sBaDiFmD33ECSCGkjg1fRGJDQBjvoVPrvM6zlal0zi?=
 =?us-ascii?Q?ICpUvb1HhaiRacinC+JuBKw21Gn1tGsIZLxbqADPZ2B7LDZdQF0uTRCU3JoC?=
 =?us-ascii?Q?e01dfGo4Pe03hJO/lAyD+7vy9KTHLM4W3wbK/FQSrX9TxwyeOs+jpJWvAmei?=
 =?us-ascii?Q?PFhkAyH+VnFtHGpR2X8b+eZwxMjXCqOpWnGRn37nvoutuN6kYKSpri8MxRs8?=
 =?us-ascii?Q?wr0TzUKDIniT2WsAXEezxsjaWP8piBJ9W/TGUs/kWlFNQX7nqKoTg7Pl+m/G?=
 =?us-ascii?Q?+nhxcLtnsPP13YYwM/0M0WM1jdKvhwDAld7WlBuxyOz2bTnvxBMImmcRmmEE?=
 =?us-ascii?Q?/N/vJd5BVyLXQ2nV9zZ9BJPXexHuBIESH78qsCX13c/ZiM//7dic/ZR29zDM?=
 =?us-ascii?Q?kldGgC7ggbEwTBZl6/fjdygwo2wHbCBNHIstHvyvahwToCHUYKI3lJMJxG7k?=
 =?us-ascii?Q?pcQD0VYBT00UgfX7dNpfApXPRlG44f1pGmBGUOex6sf/maId1pAIysoMy0A5?=
 =?us-ascii?Q?DSSay9Pmiofn9OHJQ6hJ5okSzU6f9+M3OyB4Nq6OyVSeVqb0HW9GIVS94qwo?=
 =?us-ascii?Q?aucsutFGyAXaMKXLZiPs7pHyUN+CEcgw3dC3eyy4YekdTDrLYW9Z5Bo7+2oP?=
 =?us-ascii?Q?fp0WWkVMQkqdDZx/r1jRAIgzrbtiCI0DDDSt0L7MG43zH8i5x4Cy/8oQIsq7?=
 =?us-ascii?Q?maWJZ5mLbSzFExSCxXOv22g6erQQothmfLIc5yjauxVz/J/n38/VHzEJTC9e?=
 =?us-ascii?Q?OKxERB3Pb/i7p6lSbMu5gk72tsFPZiqEN+8qYnOPPzlpwm06p9YXkeu+Ae6C?=
 =?us-ascii?Q?yQeOumBQMtyy1UvK9H1n9YI12vUsVqwGAmt/TCJFTD14fa4xSdtlmbdOlIM5?=
 =?us-ascii?Q?NxjgTn/+S33kOBHgU5F6WhKbeViuFTgO3aDKtKMjNXqJ9cEvEkAISrPcu5zT?=
 =?us-ascii?Q?eLgLXWE4RGCBTnMQQ0kqx8FgHCv6LZt36JLVfvnpWGnj4vCoLKwzrbNapk2h?=
 =?us-ascii?Q?nglURaoYLkSEEWOCUVipW0rmT70JKLjdsfeT3xKzAFGTU1rNoHrAZGI8+ID8?=
 =?us-ascii?Q?1Nr9uG0sOdr/Yp9BvNvyI4sK0q7dVbMHXc3RmfGirPVs/NHjdeHHRG8MViKV?=
 =?us-ascii?Q?L8M1VTw9HOB5aXs9iYCS3LfGnjq4Q/jcDdppCvx/axgWucbwbPDXM4S1M+ih?=
 =?us-ascii?Q?Pw7LffOTxM1coVSdsrz7tOBFy0w0oTIzATv+L6zcAxthKpRLGt3JLMwlsia5?=
 =?us-ascii?Q?Myo2W/nSD1nLFPbR5tJe3UEylC9+i2eGl46ExQ+3s11GFcJR1LRM0wk/WIHu?=
 =?us-ascii?Q?OjFf0nGS9LzXmkcjgUSfunyjbBikw3dhZBl6siPdlF1giw85QT4TtNKbyZuX?=
 =?us-ascii?Q?K+PDk6E9LDjzpGUyBRVLC/WFhgFc9cu042syxn3xjDQ6jfWNGrHXzGX4UraO?=
 =?us-ascii?Q?Dw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AEF6EEA581DBF74F852C0802C221B91B@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 979cb3d3-dd94-4fb1-2a72-08daa3cd02bd
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Oct 2022 16:50:13.5765
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: VL3i4Cs2EwHyLOe0ZtrXefpZpNHqD/HoRgwfEFwoGxyfZ+7zcbTB71EQ9rhQU+MqLFeN51TZiYnRC2gc3mp1zw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4321
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-10-01_10,2022-09-29_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 adultscore=0
 mlxlogscore=999 malwarescore=0 bulkscore=0 mlxscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210010109
X-Proofpoint-GUID: -LiYOSxriMMAJM_84iZe0fiuphjWCGfO
X-Proofpoint-ORIG-GUID: -LiYOSxriMMAJM_84iZe0fiuphjWCGfO
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Oct 1, 2022, at 12:40 PM, Jeff Layton <jlayton@kernel.org> wrote:
>=20
> On Sat, 2022-10-01 at 15:33 +0000, Chuck Lever III wrote:
>> Hi Jeff-
>>=20
>>> On Oct 1, 2022, at 5:59 AM, Jeff Layton <jlayton@kernel.org> wrote:
>>>=20
>>> nfsd_file is RCU-freed, so it's possible that one could be found that's
>>> in the process of being freed and the memory recycled. Ensure we hold
>>> the rcu_read_lock while attempting to get a reference on the object.
>>=20
>> I'm OK with entertaining clean-up patches in this code, but I
>> am skeptical that this patch addresses the concern enumerated
>> in bug #394. As you've pointed out to me before, the "UAF on
>> DELEGRETURN crashes" appeared well before v5.19, which is the
>> kernel release where this bit of code was introduced.
>>=20
>=20
> Yeah, there may be more than one bug here. In any case, these patches
> should close potential races, so I think we ought to take them.

Agreed, all of these are valid and desirable improvements.

I've applied the two from yesterday to my internal tree for more
testing. I plan to apply this one as well once the wrinkles are
ironed out. Since these are a bit late in the cycle, I plan to
push the set to Linus after the initial nfsd-6.1 PR, either near
the end of the merge window or in -rc1.


--
Chuck Lever