Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a67657a authored by Trond Myklebust's avatar Trond Myklebust
Browse files

SUNRPC: Fix race corrupting rpc upcall 



If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
after rpc_pipe_release calls rpc_purge_list(), but before it calls
gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
will free a message without deleting it from the rpci->pipe list.

We will be left with a freed object on the rpc->pipe list.  Most
frequent symptoms are kernel crashes in rpc.gssd system calls on the
pipe in question.

Reported-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@kernel.org
parent f2d47d02

net/sunrpc/auth_gss/auth_gss.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -745,17 +745,18 @@ gss_pipe_release(struct inode *inode) 
	struct rpc_inode *rpci = RPC_I(inode);

	struct rpc_inode *rpci = RPC_I(inode);

	struct gss_upcall_msg *gss_msg;

	struct gss_upcall_msg *gss_msg;





restart:

	spin_lock(&inode->i_lock);

	spin_lock(&inode->i_lock);

	while (!list_empty(&rpci->in_downcall)) {

	list_for_each_entry(gss_msg, &rpci->in_downcall, list) {





		gss_msg = list_entry(rpci->in_downcall.next,

		if (!list_empty(&gss_msg->msg.list))

				struct gss_upcall_msg, list);

			continue;

		gss_msg->msg.errno = -EPIPE;

		gss_msg->msg.errno = -EPIPE;

		atomic_inc(&gss_msg->count);

		atomic_inc(&gss_msg->count);

		__gss_unhash_msg(gss_msg);

		__gss_unhash_msg(gss_msg);

		spin_unlock(&inode->i_lock);

		spin_unlock(&inode->i_lock);

		gss_release_msg(gss_msg);

		gss_release_msg(gss_msg);

		spin_lock(&inode->i_lock);

		goto restart;

	}

	}

	spin_unlock(&inode->i_lock);

	spin_unlock(&inode->i_lock);

net/sunrpc/rpc_pipe.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -48,7 +48,7 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head, 
		return;

		return;

	do {

	do {

		msg = list_entry(head->next, struct rpc_pipe_msg, list);

		msg = list_entry(head->next, struct rpc_pipe_msg, list);

		list_del(&msg->list);

		list_del_init(&msg->list);

		msg->errno = err;

		msg->errno = err;

		destroy_msg(msg);

		destroy_msg(msg);

	} while (!list_empty(head));

	} while (!list_empty(head));
@@ -208,7 +208,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp) 
	if (msg != NULL) {

	if (msg != NULL) {

		spin_lock(&inode->i_lock);

		spin_lock(&inode->i_lock);

		msg->errno = -EAGAIN;

		msg->errno = -EAGAIN;

		list_del(&msg->list);

		list_del_init(&msg->list);

		spin_unlock(&inode->i_lock);

		spin_unlock(&inode->i_lock);

		rpci->ops->destroy_msg(msg);

		rpci->ops->destroy_msg(msg);

	}

	}
@@ -268,7 +268,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset) 
	if (res < 0 || msg->len == msg->copied) {

	if (res < 0 || msg->len == msg->copied) {

		filp->private_data = NULL;

		filp->private_data = NULL;

		spin_lock(&inode->i_lock);

		spin_lock(&inode->i_lock);

		list_del(&msg->list);

		list_del_init(&msg->list);

		spin_unlock(&inode->i_lock);

		spin_unlock(&inode->i_lock);

		rpci->ops->destroy_msg(msg);

		rpci->ops->destroy_msg(msg);

	}

	}