Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Xingyuan Mo <hdthky0@gmail.com>
CC:     Jeff Layton <jlayton@kernel.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Dai Ngo <dai.ngo@oracle.com>
Subject: Re: [PATCH] NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
Thread-Topic: [PATCH] NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
Thread-Index: AQHZJdlatWNrD7+9zUSB2GYYLTUZ+q6aEgOA
Date:   Thu, 12 Jan 2023 02:37:48 +0000
Message-ID: <02DC2FDE-D0EB-4793-9840-2D9282E1C7A2@oracle.com>
References: <20230111162453.8295-1-hdthky0@gmail.com>
In-Reply-To: <20230111162453.8295-1-hdthky0@gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?Eaz1JY4otU7A95rb+WGYHsslysIYApQC1BAYkBr5emf4Yi14D+fHGAYFP4HM?=
 =?us-ascii?Q?vUBHFDLG0j9CogYsyLUcPSG9lCBaviYr0iStF6JfJ26hehXsSc9ORNlGg40B?=
 =?us-ascii?Q?4KYK7M2fOLGKZPVQ3cKGV+19g5vM3prrMC1Hyk+/FIFlamOhwjdR+2RrzbGP?=
 =?us-ascii?Q?GcXzywGH9krleLMf5jXKe/NzUgHb/GYRDB7wudZhd96IdANOiLdnBhiYeJaR?=
 =?us-ascii?Q?UAccl1YZ4/2fCm3daCXvB/j9pJ7xF0eNDjRqUARMlo202GNn2KiFaoTm3ECd?=
 =?us-ascii?Q?5GpqRRSuns/Yp8BB82NRzSa/JrUgwb2Q63Aho85L4VNKgwiALINOLI6i2Rtf?=
 =?us-ascii?Q?9uwarF/eGM2ZQQBc1wPMSugVSSTb/Zku+ZHFSFBvKBYOKRBFENFGKSw39CKl?=
 =?us-ascii?Q?/ls8GHn0L59yVLbQ0ZoEg/Ts8bUtArazIJrBhzCBPPRnA7vFLavWM9CgZQP0?=
 =?us-ascii?Q?SfWSt3BvaNfs2V+U89y7CKOixSousQk2xjHxanwpk0eLywqRpIyWnn500mzh?=
 =?us-ascii?Q?YECC44b0TVCq/tlBsYIIkoydXV9GZOn8/Pm8H/EmsX7KypIe0j4xWiJkEsHz?=
 =?us-ascii?Q?5wugEM/FDkcS8762t59GLxvCkkh09AhzCnuzPA83EJQvhX791tMOGVsUifq2?=
 =?us-ascii?Q?GkE+fpKfHWHCKWommsSNig7dEkT+mQgqMO+rxSm8QiNhTK+V6lHjlE5QVv6m?=
 =?us-ascii?Q?j7owLun2C7/npDtqKMXkc+xiKo7+zgvppFsuPIA840Z1NNo1ZIDsGqrvmh5z?=
 =?us-ascii?Q?VmOKvrWXXkn4qeu2uU7MOrcQrxZTV2Dz3QjKp+pwIWBkwN6hajjocbY4IIsg?=
 =?us-ascii?Q?eT4n6izSWLtpAT0VGdNMInE1KzzusatVSjVgCsCM6AlL5DB+OM1gV/73XhcW?=
 =?us-ascii?Q?t9KMH/7b4zYNkmniRZeIWA9YH7KKsDs5OJ68JTf5euvqgamwLzQkETFrtHEn?=
 =?us-ascii?Q?CTz5SpoIYb0dgMxb2s/JTZI1dFqGNLENalrmRRnl2yDmuG5zQIy9Y+JNnRKw?=
 =?us-ascii?Q?JdIBt8ryv7OdoOLea1o0Jz6a9AcV8OyrArPiMpJR0tq9tANul6f1MuIrAucO?=
 =?us-ascii?Q?y3kVxXIgNSm3+/75kzJTf5r9v+n/BczHpWmooMHIdSHDbJXd9XJAw52ybhaK?=
 =?us-ascii?Q?FYTOXx5SXVZPvN3Vm2UpiH++ZBSLUCzAlky3l5BZeV3/2yF/0+dZelIOGGbo?=
 =?us-ascii?Q?RmPzbfufS5NRB7GDEmLlNueBF38jQDAIF1gOemPQxcA+kcwMeGpNoVFjQcIs?=
 =?us-ascii?Q?/70sW10oMJP1WxQl02Z8bJzytaKjqp5ktaxt87LrRtTxnL+y5jcQeb4ZUmRe?=
 =?us-ascii?Q?2tSTMVlbw77g6PlqxQ0YoYOxU0y0vQIjTCQo7l0fSk+AHl8CiY5vfDGpE028?=
 =?us-ascii?Q?dXzEVw86KiEVqrZVwHoDuxjkDYcIt5Ep8qHd4RlHDHIFIVMzMa+6SfmqKA2M?=
 =?us-ascii?Q?ig3Dp53257FsUBuh6+fc8MZy+A9WOSL/4qqLJJgnUYyUB6+39Ka506iZ6mce?=
 =?us-ascii?Q?F14KeYMPpncJ1TYuvKldipMZC6ZTU3ARge553g6CrN8d1knQF6KBplLWa3iq?=
 =?us-ascii?Q?Okj7T3X7MXc9vWDzvKGUG59IZXcLT5addZ6kLmNl49xbFS7s9NiLdb3NyV7F?=
 =?us-ascii?Q?ZQ=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <885CFBDB71432746A84D360A4E98527E@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: P5gQZgGCQXy1pK9jNX7k7nk4vTdFHj2XB1w2UHlZEEvTMGihK5AEWwCErKrFoAfnekpEHbWB8hkU7zX8iKETON8OX5i4xKinmLV+5DigYRrAivzYTH5KEZTZHDoizRWD3obj5Zf76SG1RF8G1xO/gtNL/uejq2fy1tcSsXL/SgK46K6WwUdK1nBz0NsfsLX6jBBign3gL9Z0GAXJA82OOgNvMgfbnUMyXT8hp1Hzd7QYzbP/BffX6oUO9t5CyKX03rv94jmzWgJ5EktFI443rqC28DM0vF7cWJQYvXYfhTvOFKG+A0m3KVGHmupGnxHiUlv2qcZ3xquVa6AMTV8bwso1j1XqroCXZq+7hZRljWSz1PH3hl/QkOhGaP9S9ji71Br782CKtwF1glT40EVp2Y8V7s6kBM5XAzfB/HHRr2UQIGpiZnff1QzkAxn/oKEzgFmoDOWBMzPYDxxNOqvkZK8XVA06KcHl4oOcWuDU3+IlEX84F2GFIuq1GW28zgXachTcrxkNNjrDAMK3FT3vVfc8crQ5kCDgIrgYg8SNGNa3nAcojSLkC78TDCDjxCksN/LadNNFxgsYRuzJjIjpjFZHmjaZiDKZydYt2PLpsLhtq2pSqvygl9cK2wLsKuQL3YkoJbQgEUZM6NJram8mc0I1iW87Uy0SugF0/30pGwKbdLioyA+/7nq9Agi6kJ3yIPis9pwVjs8rHuZTmuYtbqhiCD6wg+LsA3zEbunkRGK9qo8aNGZJjWm9uWnLueC19urPOxoozwadsTyQ6+U9EjJahcY6rx8DzX3+vNuZ2poKMjTgrVaPAi/r0Sxmwr5I
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b89da9fb-8cdb-49d1-8e40-08daf445fe49
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2023 02:37:48.2338
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: jZMUkliuVOcbJMO3MCUXSm4B/7udR7NmRoslVSIp1DvWGBDWoELDiu8hDEtac7qAODgV3cCwI1bQnNgUKvEpbA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR10MB7169
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2023-01-11_10,2023-01-11_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999
 bulkscore=0 mlxscore=0 phishscore=0 adultscore=0 suspectscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2212070000 definitions=main-2301120015
X-Proofpoint-GUID: scdXJY8wDxMzIGwcEEQakefVC0RIk2t0
X-Proofpoint-ORIG-GUID: scdXJY8wDxMzIGwcEEQakefVC0RIk2t0
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Jan 11, 2023, at 11:24 AM, Xingyuan Mo <hdthky0@gmail.com> wrote:
>=20
> If signal_pending() returns true, schedule_timeout() will not be executed=
,
> causing the waiting task to remain in the wait queue.
> Fixed by adding a call to finish_wait(), which ensures that the waiting
> task will always be removed from the wait queue.
>=20
> Reported-by: Xingyuan Mo <hdthky0@gmail.com>
> Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>

Hello, applied to nfsd's for-rc, thanks! I expect to send a PR for to Linus
in a few days.


> ---
> fs/nfsd/nfs4proc.c | 1 +
> 1 file changed, 1 insertion(+)
>=20
> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
> index bd880d55f565..3fa819e29b3f 100644
> --- a/fs/nfsd/nfs4proc.c
> +++ b/fs/nfsd/nfs4proc.c
> @@ -1318,6 +1318,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *=
nn, char *ipaddr,
> 			/* allow 20secs for mount/unmount for now - revisit */
> 			if (signal_pending(current) ||
> 					(schedule_timeout(20*HZ) =3D=3D 0)) {
> +				finish_wait(&nn->nfsd_ssc_waitq, &wait);
> 				kfree(work);
> 				return nfserr_eagain;
> 			}
> --=20
> 2.34.1
>=20

--
Chuck Lever