Commit 75333d48 authored by Dai Ngo's avatar Dai Ngo Committed by Chuck Lever
Browse files

NFSD: fix use-after-free in __nfs42_ssc_open() 



Problem caused by source's vfsmount being unmounted but remains
on the delayed unmount list. This happens when nfs42_ssc_open()
return errors.

Fixed by removing nfsd4_interssc_connect(), leave the vfsmount
for the laundromat to unmount when idle time expires.

We don't need to call nfs_do_sb_deactive when nfs42_ssc_open
return errors since the file was not opened so nfs_server->active
was not incremented. Same as in nfsd4_copy, if we fail to
launch nfsd4_do_async_copy thread then there's no need to
call nfs_do_sb_deactive

Reported-by: default avatarXingyuan Mo <hdthky0@gmail.com>
Signed-off-by: default avatarDai Ngo <dai.ngo@oracle.com>
Tested-by: default avatarXingyuan Mo <hdthky0@gmail.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 3bc8edc9

fs/nfsd/nfs4proc.c

+5 −15
Original line number Diff line number Diff line
@@ -1461,13 +1461,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, 
	return status;

}



static void

nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)

{

	nfs_do_sb_deactive(ss_mnt->mnt_sb);

	mntput(ss_mnt);

}



/*

 * Verify COPY destination stateid.

 *
@@ -1570,11 +1563,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, 
{

}



static void

nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)

{

}



static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt,

				   struct nfs_fh *src_fh,

				   nfs4_stateid *stateid)
@@ -1770,7 +1758,7 @@ static int nfsd4_do_async_copy(void *data) 
			default:

				nfserr = nfserr_offload_denied;

			}

			nfsd4_interssc_disconnect(copy->ss_mnt);

			/* ss_mnt will be unmounted by the laundromat */

			goto do_callback;

		}

		nfserr = nfsd4_do_copy(copy, filp, copy->nf_dst->nf_file,
@@ -1851,8 +1839,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
	if (async_copy)

		cleanup_async_copy(async_copy);

	status = nfserrno(-ENOMEM);

	if (nfsd4_ssc_is_inter(copy))

		nfsd4_interssc_disconnect(copy->ss_mnt);

	/*

	 * source's vfsmount of inter-copy will be unmounted

	 * by the laundromat

	 */

	goto out;

}