Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1731060

[PATCH 4.12 20/22] NFS: Fix 2 use after free issues in the I/O code

Show all headers | View raw

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 196639ebbe63a037fe9a80669140bd292d8bcd80 upstream.

The writeback code wants to send a commit after processing the pages,
which is why we want to delay releasing the struct path until after
that's done.

Also, the layout code expects that we do not free the inode before
we've put the layout segments in pnfs_writehdr_free() and
pnfs_readhdr_free()

Fixes: 919e3bd9a875 ("NFS: Ensure we commit after writeback is complete")
Fixes: 4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/internal.h |    1 -
 fs/nfs/pagelist.c |   26 ++++++++++++--------------
 fs/nfs/pnfs.c     |    2 --
 3 files changed, 12 insertions(+), 17 deletions(-)

--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -248,7 +248,6 @@ int nfs_iocounter_wait(struct nfs_lock_c
 extern const struct nfs_pageio_ops nfs_pgio_rw_ops;
 struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *);
 void nfs_pgio_header_free(struct nfs_pgio_header *);
-void nfs_pgio_data_destroy(struct nfs_pgio_header *);
 int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *);
 int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr,
 		      struct rpc_cred *cred, const struct nfs_rpc_ops *rpc_ops,
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -515,16 +515,6 @@ struct nfs_pgio_header *nfs_pgio_header_
 }
 EXPORT_SYMBOL_GPL(nfs_pgio_header_alloc);
 
-/*
- * nfs_pgio_header_free - Free a read or write header
- * @hdr: The header to free
- */
-void nfs_pgio_header_free(struct nfs_pgio_header *hdr)
-{
-	hdr->rw_ops->rw_free_header(hdr);
-}
-EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
-
 /**
  * nfs_pgio_data_destroy - make @hdr suitable for reuse
  *
@@ -533,14 +523,24 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
  *
  * @hdr: A header that has had nfs_generic_pgio called
  */
-void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr)
+static void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr)
 {
 	if (hdr->args.context)
 		put_nfs_open_context(hdr->args.context);
 	if (hdr->page_array.pagevec != hdr->page_array.page_array)
 		kfree(hdr->page_array.pagevec);
 }
-EXPORT_SYMBOL_GPL(nfs_pgio_data_destroy);
+
+/*
+ * nfs_pgio_header_free - Free a read or write header
+ * @hdr: The header to free
+ */
+void nfs_pgio_header_free(struct nfs_pgio_header *hdr)
+{
+	nfs_pgio_data_destroy(hdr);
+	hdr->rw_ops->rw_free_header(hdr);
+}
+EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
 
 /**
  * nfs_pgio_rpcsetup - Set up arguments for a pageio call
@@ -654,7 +654,6 @@ EXPORT_SYMBOL_GPL(nfs_initiate_pgio);
 static void nfs_pgio_error(struct nfs_pgio_header *hdr)
 {
 	set_bit(NFS_IOHDR_REDO, &hdr->flags);
-	nfs_pgio_data_destroy(hdr);
 	hdr->completion_ops->completion(hdr);
 }
 
@@ -665,7 +664,6 @@ static void nfs_pgio_error(struct nfs_pg
 static void nfs_pgio_release(void *calldata)
 {
 	struct nfs_pgio_header *hdr = calldata;
-	nfs_pgio_data_destroy(hdr);
 	hdr->completion_ops->completion(hdr);
 }
 
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2274,7 +2274,6 @@ pnfs_write_through_mds(struct nfs_pageio
 		nfs_pageio_reset_write_mds(desc);
 		mirror->pg_recoalesce = 1;
 	}
-	nfs_pgio_data_destroy(hdr);
 	hdr->release(hdr);
 }
 
@@ -2398,7 +2397,6 @@ pnfs_read_through_mds(struct nfs_pageio_
 		nfs_pageio_reset_read_mds(desc);
 		mirror->pg_recoalesce = 1;
 	}
-	nfs_pgio_data_destroy(hdr);
 	hdr->release(hdr);
 }
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.12 00/22] 4.12.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 18/22] ARM64: dts: marvell: armada-37xx: Fix GIC maintenance interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 22/22] NFSv4: Fix up mirror allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 20/22] NFS: Fix 2 use after free issues in the I/O code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 02/22] mtd: nand: hynix: add support for 20nm NAND chips Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 13/22] mm/memory.c: fix mem_cgroup_oom_disable() call missing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 12/22] mm/swapfile.c: fix swapon frontswap_map memory leak on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 06/22] nvme-fabrics: generate spec-compliant UUID NQNs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:10 +0200
  [PATCH 4.12 08/22] rtlwifi: btcoexist: Fix breakage of ant_sel for rtl8723be Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 09/22] radix-tree: must check __radix_tree_preload() return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 03/22] mtd: nand: mxc: Fix mxc_v1 ooblayout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 21/22] NFS: Sync the correct byte range during synchronous writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 07/22] btrfs: resume qgroup rescan on rw remount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 10/22] selftests/x86/fsgsbase: Test selectors 1, 2, and 3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 05/22] mtd: nand: qcom: fix config error for BCH Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  [PATCH 4.12 04/22] mtd: nand: qcom: fix read failure without complete bootchain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-12 19:20 +0200
  Re: [PATCH 4.12 00/22] 4.12.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-13 02:20 +0200
  Re: [PATCH 4.12 00/22] 4.12.13-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-13 16:40 +0200

csiph-web