Unverified Commit 6556276e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14388 CVE-2024-53173 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/R6JQXM54JN2JGQQIVRJ4RSTJKHSXJMWA/ 
Li Lingfeng (2):
  Revert "nfs: fix rpc_task use-after-free when open and close different
    files concurrently"
  Revert "NFSv4: release seqid when open failed for nfs4.0"

Trond Myklebust (2):
  NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid()
  NFSv4.0: Fix a use-after-free problem in the asynchronous open()


-- 
2.31.1
 
https://gitee.com/src-openeuler/kernel/issues/IBEAFI 
 
Link:https://gitee.com/openeuler/kernel/pulls/14388

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents d51fb86c cb0875bc

fs/nfs/nfs4_fs.h

+0 −1
Original line number Diff line number Diff line
@@ -521,7 +521,6 @@ extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_ 
extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);

extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid);

extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid);

extern void nfs_release_seqid_inorder(struct nfs_seqid *seqid);

extern void nfs_release_seqid(struct nfs_seqid *seqid);

extern void nfs_free_seqid(struct nfs_seqid *seqid);

extern int nfs4_setup_sequence(struct nfs_client *client,

fs/nfs/nfs4proc.c

+6 −6
Original line number Diff line number Diff line
@@ -2518,14 +2518,14 @@ static void nfs4_open_release(void *calldata) 
	struct nfs4_opendata *data = calldata;

	struct nfs4_state *state = NULL;



	if (data->rpc_status != 0 || !data->rpc_done)

		nfs_release_seqid_inorder(data->o_arg.seqid);

	/* In case of error, no cleanup! */

	if (data->rpc_status != 0 || !data->rpc_done) {

		nfs_release_seqid(data->o_arg.seqid);

		goto out_free;

	}

	/* If this request hasn't been cancelled, do nothing */

	if (!data->cancelled)

		goto out_free;

	/* In case of error, no cleanup! */

	if (data->rpc_status != 0 || !data->rpc_done)

		goto out_free;

	/* In case we need an open_confirm, no cleanup! */

	if (data->o_res.rflags & NFS4_OPEN_RESULT_CONFIRM)

		goto out_free;
@@ -3606,7 +3606,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) 
			res_stateid, calldata->arg.fmode);

out_release:

	task->tk_status = 0;

	nfs_release_seqid_inorder(calldata->arg.seqid);

	nfs_release_seqid(calldata->arg.seqid);

	nfs_refresh_inode(calldata->inode, &calldata->fattr);

	dprintk("%s: done, ret = %d!\n", __func__, task->tk_status);

	return;

fs/nfs/nfs4state.c

+4 −24
Original line number Diff line number Diff line
@@ -1088,24 +1088,6 @@ struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_m 
	return new;

}



void nfs_release_seqid_inorder(struct nfs_seqid *seqid)

{

	struct nfs_seqid_counter *sequence;



	if (seqid == NULL || list_empty(&seqid->list))

		return;

	sequence = seqid->sequence;

	spin_lock(&sequence->lock);

	if (!list_is_last(&seqid->list, &sequence->list)) {

		struct nfs_seqid *next;



		next = list_next_entry(seqid, list);

		rpc_wake_up_queued_task(&sequence->wait, next->task);

	}

	list_del_init(&seqid->list);

	spin_unlock(&sequence->lock);

}



void nfs_release_seqid(struct nfs_seqid *seqid)

{

	struct nfs_seqid_counter *sequence;
@@ -1114,14 +1096,12 @@ void nfs_release_seqid(struct nfs_seqid *seqid) 
		return;

	sequence = seqid->sequence;

	spin_lock(&sequence->lock);

	list_del_init(&seqid->list);

	if (!list_empty(&sequence->list)) {

		struct nfs_seqid *next;



		next = list_first_entry(&sequence->list,

				struct nfs_seqid, list);

	if (list_is_first(&seqid->list, &sequence->list) &&

	    !list_is_singular(&sequence->list)) {

		struct nfs_seqid *next = list_next_entry(seqid, list);

		rpc_wake_up_queued_task(&sequence->wait, next->task);

	}

	list_del_init(&seqid->list);

	spin_unlock(&sequence->lock);

}