Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp2086rwd; Fri, 19 May 2023 14:19:48 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5qk8C7MVGAQraZacOQsNx/x2HUmiqcSYhS0ZYQb9XY4FsMvshkNA0569ySXWSzzKl0lZ2g X-Received: by 2002:a17:90a:898f:b0:253:35aa:1378 with SMTP id v15-20020a17090a898f00b0025335aa1378mr2908766pjn.35.1684531187988; Fri, 19 May 2023 14:19:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684531187; cv=none; d=google.com; s=arc-20160816; b=k3svYlZ7jgEbKzAeJKrkWSY6YZkaIjOBn1xJ6RpWSwByEpPIiJ98gjU6QVaBh9RmiA mEwP9SAzZXbrhR+Yr9WI3CQUmp1h6YR59WL/RcO+JggvMKvB7J3UA4PVrj1ZFgZAugDT 5aUkKsSHw03j3gNZIsjc4JL0W5SRMMQUuXqQ7uJzrRSPjrO6xevCrI5m3tayGtBhMAfy QnnDTIVwUm91BzGa3NmVhtta17rWsYf/HKh4V975W+eII8lsNM7QYv7e2hWrOWg9izzl eufBqKp+w8avsLSN7J890aVo8shugy8XoOVEKTZ3OqTVlCu5uiHYlQ9DiNTEGyDCWkE3 GHhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=uiqYqLxwRXLO0jsD8TFhJfCY3/Z+kY9yWGWuI+1Hv20=; b=T02+6JRKA/uY+xvUV9ySNGG5eZf29J4NLWkrfmdyffuPvtKDg6M6hifeKXZnL/Yxgp kUHslQdOLcvMXih1XWONYE2iB7P8KvOShhBPOgoTNoWXwXEfgwie0XcHtKfwBUWpZ8+/ /7niTW5vJOV2GYnkf5AhpXL6HhrEC7cVDVuqw2Vio6Pn+c6rURoQJSl4Aj2iRfx6SRVz +VBqo+EFYTokGMIWVNeLBcwdeCqGhTXbmNpEWuRcIOYrQvv9nskwZiFOZoHqRI4Fy3NF ijCBdf0epLcawzWkaT8CB3bOu5ptju0GyGAudgyzd0Zx60ZDBwYDEZO1SbnJ1IIYvBN8 P9CA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=V38r1Mef; spf=pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s22-20020a17090ad49600b002498408b1c5si2359657pju.39.2023.05.19.14.19.25; Fri, 19 May 2023 14:19:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=V38r1Mef; spf=pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-nfs-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229661AbjESVRm (ORCPT + 99 others); Fri, 19 May 2023 17:17:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229579AbjESVRm (ORCPT ); Fri, 19 May 2023 17:17:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91C87BC for ; Fri, 19 May 2023 14:17:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 264DC65A94 for ; Fri, 19 May 2023 21:17:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10D5CC433EF; Fri, 19 May 2023 21:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684531060; bh=R/vsGa5niqnZgVwu5aJ6saZhFWPo59AqHcVWH51bmKw=; h=From:To:Cc:Subject:Date:From; b=V38r1Mefcan9WTVrdx5JIp4aiSDktCkUUWm4vL4vhVy+C7WeW6GIoHxo2gbLSbXII 9ZVPkV+WVCnqIARRQ54PlNulvXqHwyKgz/pH1uBSoVTpx2jj/nGCKu/VN25JIvGpnn M1VL+aw+xTNg9FqNnDQqPr1QNg2tj8UcKvSxMDymAsyyM9LqPV7yP/m0SWtogVZlhE BPu0oZszdYW8NYUE0DoK9wBXeGAWm6oRazPD6QDqJpDP1kSH3EWw/S9DkIoj4Sjw/Q F0TPc3idmJWaf5GtGVkhtD3gu7ebPBZqEKEBQEB/i6jBsocJkX5Tx7+gh/xfmnO2i/ 6RwXiZBCCPDEQ== From: Anna Schumaker To: linux-nfs@vger.kernel.org, trond.myklebust@hammerspace.com Cc: anna@kernel.org Subject: [PATCH] NFSv4.2: Fix a potential double free with READ_PLUS Date: Fri, 19 May 2023 17:17:36 -0400 Message-Id: <20230519211736.246568-1-anna@kernel.org> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: Anna Schumaker kfree()-ing the scratch page isn't enough, we also need to set the pointer back to NULL to avoid a double-free in the case of a resend. Fixes: fbd2a05f29a9 (NFSv4.2: Rework scratch handling for READ_PLUS) Signed-off-by: Anna Schumaker --- fs/nfs/nfs4proc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 18f25ff4bff7..d3665390c4cb 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -5437,10 +5437,18 @@ static bool nfs4_read_plus_not_supported(struct rpc_task *task, return false; } -static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) +static inline void nfs4_read_plus_scratch_free(struct nfs_pgio_header *hdr) { - if (hdr->res.scratch) + if (hdr->res.scratch) { kfree(hdr->res.scratch); + hdr->res.scratch = NULL; + } +} + +static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) +{ + nfs4_read_plus_scratch_free(hdr); + if (!nfs4_sequence_done(task, &hdr->res.seq_res)) return -EAGAIN; if (nfs4_read_stateid_changed(task, &hdr->args)) -- 2.40.1