Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Jeff Layton <jlayton@kernel.org>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        kernel test robot <lkp@intel.com>,
        Dan Carpenter <error27@gmail.com>
Subject: Re: [PATCH] nfsd: fix use-after-free in nfsd_file_do_acquire
 tracepoint
Thread-Topic: [PATCH] nfsd: fix use-after-free in nfsd_file_do_acquire
 tracepoint
Thread-Index: AQHY8R1vzMCgpPcPH0iHb0w/pOeG964wd9AA
Date:   Sat, 5 Nov 2022 15:41:09 +0000
Message-ID: <C331D33E-9C80-4B1D-AD1A-9475656FCE5B@oracle.com>
References: <20221105134926.23726-1-jlayton@kernel.org>
In-Reply-To: <20221105134926.23726-1-jlayton@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?sbKhYSQ8cLqAXnDc9HW4MEqWWQJhprWJOQIeDMaDPUBhSTL7NNcVxRXDA9kw?=
 =?us-ascii?Q?HXNN1Vf0/+h4Bl1BiC/H8/TDAGrGW0qcPRL/sXxjeOMy7gJDTjh//HLErddr?=
 =?us-ascii?Q?pSFupCOnmj3Ofx7GAOytii4hbENdqlY1fKDjkRDUq4KVE1yIYlYaAo4mxB1Z?=
 =?us-ascii?Q?7sRtGamzpD1jU177w3gwCGmQu2hzwHdUHv6Pz0dkR8QlvZXNKnMV/kE+xsVs?=
 =?us-ascii?Q?pMb4/mivOxcsgBgGkarLAXZvDgfXLaC8C8Xp13JVesXTUVIz0KCfaiMpJGhc?=
 =?us-ascii?Q?jXJkAhI5WAn8LL9R7gvpq5QxYbP+qGmn0yiMYGKekcl3j+OwMXtF4ORu1a3r?=
 =?us-ascii?Q?A2CnamU+Z7BG0uXkTF+3WeaQl5DgQMfrH6BeNUNGFT4jDIKVW+TDfmELPPqt?=
 =?us-ascii?Q?vLrzy9My7JCvboaHXjNHF5erdJ+ibqOtKzDGwA9BlELSZNXfI+D5NwQNE9dl?=
 =?us-ascii?Q?sgOUGK8Ba02TNS1HwNcPwxXBWOG1028xNhs2gsWrThTgZUbrt9ACDWtPLp8p?=
 =?us-ascii?Q?LI5BmgrfpZ4zc/Nl+tamRrrnIv1/YUt0cgoi9zANrRutZOAikAeWvGph9hNh?=
 =?us-ascii?Q?jGn9G7C5Emxhc9+aYE/BhmjAOYqA13h1nXHK0RIj0HzruJNgyKIPmBxz5l7l?=
 =?us-ascii?Q?+XOVRo5qnS75tyhkxZbu05hI/G/V3R2J90S4AXCX11cSstK4ZeEEiibIsA5o?=
 =?us-ascii?Q?7OlYTNymvDQNb8BQLp2M1f5PShb2FbhlbAdjLjrdUPN5t1b9W2LKmricYy5c?=
 =?us-ascii?Q?fI3BUntzsDPpyGwDLceIZ14T8omGk9mEvoKDbfWlSIM6kGERAyw6kE7Cb4dA?=
 =?us-ascii?Q?tDvfBlGeYpkyU2js8/I/zHfpDEUEW4kfW3HtTb0AO9OVaBNJ4022nt64A9TX?=
 =?us-ascii?Q?WC+KwPMNuqZjWVkdha3kbUyjaSyJfh9s9EfPyqXDx3H24wPt0OMDMqxBrOgI?=
 =?us-ascii?Q?Sny2X4NvMjQO6YsED8CR9txtON2Eh9HEjydkFxKpp6RlU23YUG/NDxKGHHqd?=
 =?us-ascii?Q?jmkURx7rFCTlnXahO50f5ZbRIZRskEFd3q1G7tKC9kwSZmgfGCFuJdGsmRwM?=
 =?us-ascii?Q?8lDncvpasXNJciPchknEHD4s1YBmGvVF12+rGcF9PVS6S4q6kZXJ6UxXY9yw?=
 =?us-ascii?Q?RKUDbx76x7b6FNBeAoWkLpMhSBr6UKmbALNyIVKH1aynzITk8bAyA2Lv5zJo?=
 =?us-ascii?Q?HlwBId5wFS55+KhfeqydmvU45UT9sac/h0uRX0of0sBfH2B7WpRLqEvxZwri?=
 =?us-ascii?Q?B5gBLR+7rJFu6ObdSlLF5qo8VbZ6CP5u7NoqOLXs+XsJo96ofFo8ihfcaJEx?=
 =?us-ascii?Q?BdPwt2ijXVKVKwNRCouum4ARsbBDSb6IYzy6uH4X0zJ/M9tRYFC0SGcuJ+oN?=
 =?us-ascii?Q?NuzSlr21tks1TIduG2As/nqx3fGR8upbK6iDN76+Xf8v0geDgJ0QG9nSa+Hy?=
 =?us-ascii?Q?9peLNmahaEr5eQTsbpY7nrQLXCQRxcVOvb5M1Zck+L/4pj9E9P730az3i2tS?=
 =?us-ascii?Q?3ICXzDKZnzF03sg6koe2gkrhaOWaXwv5+L4B24k/03kZlfgU9bytTJdj/zPC?=
 =?us-ascii?Q?Vjwl1neUaeado8u/uoDz7ZK+sadmbNllHIG4pE4yeNpFYy2whDsCWtSbFzYK?=
 =?us-ascii?Q?UA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <BC823C381EB3D54985048E86F3460448@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5134.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cbe76f4e-1592-49d1-3ff6-08dabf4428ed
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Nov 2022 15:41:09.1352
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: IWIAqoxyKmwb3z+HScgvk/quEY+5TM+a6jMxycrEFaBmOrN197ZfweOVVYF+KUMcTPdulkGUeRlhAXJZYhq5ug==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB6247
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-05_09,2022-11-03_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0
 phishscore=0 bulkscore=0 suspectscore=0 spamscore=0 malwarescore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2210170000 definitions=main-2211050118
X-Proofpoint-ORIG-GUID: KJy-apSMC76I7SH5LDW3BKwRo3ij4c7D
X-Proofpoint-GUID: KJy-apSMC76I7SH5LDW3BKwRo3ij4c7D
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Nov 5, 2022, at 9:49 AM, Jeff Layton <jlayton@kernel.org> wrote:
>=20
> When we fail to insert into the hashtable with a non-retryable error,
> we'll free the object and then goto out_status. If the tracepoint is
> enabled, it'll end up accessing the freed object when it tries to
> grab the fields out of it.
>=20
> Set nf to NULL after freeing it to avoid the issue.
>=20
> Fixes: 243a5263014a ("nfsd: rework hashtable handling in nfsd_do_file_acq=
uire")
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
> fs/nfsd/filecache.c | 1 +
> 1 file changed, 1 insertion(+)

I've applied this to nfsd's for-rc. Thank you!


> diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> index 687ab814b678..02c1454dfe50 100644
> --- a/fs/nfsd/filecache.c
> +++ b/fs/nfsd/filecache.c
> @@ -1124,6 +1124,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct=
 svc_fh *fhp,
> 		goto open_file;
>=20
> 	nfsd_file_slab_free(&nf->nf_rcu);
> +	nf =3D NULL;
> 	if (ret =3D=3D -EEXIST)
> 		goto retry;
> 	trace_nfsd_file_insert_err(rqstp, key.inode, may_flags, ret);
> --=20
> 2.38.1
>=20

--
Chuck Lever