Commit c1649ec5 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux 

Pull nfsd fixes from Chuck Lever:

 - Fix recently introduced use-after-free bugs

* tag 'nfsd-6.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  NFSD: replace delayed_work with work_struct for nfsd_client_shrinker
  NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time
  NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
parents 2bbb0674 7c24fa22

fs/nfsd/netns.h

+1 −1
Original line number Diff line number Diff line
@@ -195,7 +195,7 @@ struct nfsd_net { 


	atomic_t		nfsd_courtesy_clients;

	struct shrinker		nfsd_client_shrinker;

	struct delayed_work	nfsd_shrinker_work;

	struct work_struct	nfsd_shrinker_work;

};



/* Simple check to find out if a given net was properly initialized */

fs/nfsd/nfs4proc.c

+1 −0
Original line number Diff line number Diff line
@@ -1318,6 +1318,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, 
			/* allow 20secs for mount/unmount for now - revisit */

			if (signal_pending(current) ||

					(schedule_timeout(20*HZ) == 0)) {

				finish_wait(&nn->nfsd_ssc_waitq, &wait);

				kfree(work);

				return nfserr_eagain;

			}

fs/nfsd/nfs4state.c

+15 −15
Original line number Diff line number Diff line
@@ -4411,7 +4411,7 @@ nfsd4_state_shrinker_count(struct shrinker *shrink, struct shrink_control *sc) 
	if (!count)

		count = atomic_long_read(&num_delegations);

	if (count)

		mod_delayed_work(laundry_wq, &nn->nfsd_shrinker_work, 0);

		queue_work(laundry_wq, &nn->nfsd_shrinker_work);

	return (unsigned long)count;

}
@@ -4421,7 +4421,7 @@ nfsd4_state_shrinker_scan(struct shrinker *shrink, struct shrink_control *sc) 
	return SHRINK_STOP;

}



int

void

nfsd4_init_leases_net(struct nfsd_net *nn)

{

	struct sysinfo si;
@@ -4443,16 +4443,6 @@ nfsd4_init_leases_net(struct nfsd_net *nn) 
	nn->nfs4_max_clients = max_t(int, max_clients, NFS4_CLIENTS_PER_GB);



	atomic_set(&nn->nfsd_courtesy_clients, 0);

	nn->nfsd_client_shrinker.scan_objects = nfsd4_state_shrinker_scan;

	nn->nfsd_client_shrinker.count_objects = nfsd4_state_shrinker_count;

	nn->nfsd_client_shrinker.seeks = DEFAULT_SEEKS;

	return register_shrinker(&nn->nfsd_client_shrinker, "nfsd-client");

}



void

nfsd4_leases_net_shutdown(struct nfsd_net *nn)

{

	unregister_shrinker(&nn->nfsd_client_shrinker);

}



static void init_nfs4_replay(struct nfs4_replay *rp)
@@ -6235,8 +6225,7 @@ deleg_reaper(struct nfsd_net *nn) 
static void

nfsd4_state_shrinker_worker(struct work_struct *work)

{

	struct delayed_work *dwork = to_delayed_work(work);

	struct nfsd_net *nn = container_of(dwork, struct nfsd_net,

	struct nfsd_net *nn = container_of(work, struct nfsd_net,

				nfsd_shrinker_work);



	courtesy_client_reaper(nn);
@@ -8066,11 +8055,20 @@ static int nfs4_state_create_net(struct net *net) 
	INIT_LIST_HEAD(&nn->blocked_locks_lru);



	INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);

	INIT_DELAYED_WORK(&nn->nfsd_shrinker_work, nfsd4_state_shrinker_worker);

	INIT_WORK(&nn->nfsd_shrinker_work, nfsd4_state_shrinker_worker);

	get_net(net);



	nn->nfsd_client_shrinker.scan_objects = nfsd4_state_shrinker_scan;

	nn->nfsd_client_shrinker.count_objects = nfsd4_state_shrinker_count;

	nn->nfsd_client_shrinker.seeks = DEFAULT_SEEKS;



	if (register_shrinker(&nn->nfsd_client_shrinker, "nfsd-client"))

		goto err_shrinker;

	return 0;



err_shrinker:

	put_net(net);

	kfree(nn->sessionid_hashtbl);

err_sessionid:

	kfree(nn->unconf_id_hashtbl);

err_unconf_id:
@@ -8163,6 +8161,8 @@ nfs4_state_shutdown_net(struct net *net) 
	struct list_head *pos, *next, reaplist;

	struct nfsd_net *nn = net_generic(net, nfsd_net_id);



	unregister_shrinker(&nn->nfsd_client_shrinker);

	cancel_work(&nn->nfsd_shrinker_work);

	cancel_delayed_work_sync(&nn->laundromat_work);

	locks_end_grace(&nn->nfsd4_manager);

fs/nfsd/nfsctl.c

+1 −6
Original line number Diff line number Diff line
@@ -1457,9 +1457,7 @@ static __net_init int nfsd_init_net(struct net *net) 
		goto out_idmap_error;

	nn->nfsd_versions = NULL;

	nn->nfsd4_minorversions = NULL;

	retval = nfsd4_init_leases_net(nn);

	if (retval)

		goto out_drc_error;

	nfsd4_init_leases_net(nn);

	retval = nfsd_reply_cache_init(nn);

	if (retval)

		goto out_cache_error;
@@ -1469,8 +1467,6 @@ static __net_init int nfsd_init_net(struct net *net) 
	return 0;



out_cache_error:

	nfsd4_leases_net_shutdown(nn);

out_drc_error:

	nfsd_idmap_shutdown(net);

out_idmap_error:

	nfsd_export_shutdown(net);
@@ -1486,7 +1482,6 @@ static __net_exit void nfsd_exit_net(struct net *net) 
	nfsd_idmap_shutdown(net);

	nfsd_export_shutdown(net);

	nfsd_netns_free_versions(net_generic(net, nfsd_net_id));

	nfsd4_leases_net_shutdown(nn);

}



static struct pernet_operations nfsd_net_ops = {

fs/nfsd/nfsd.h

+2 −4
Original line number Diff line number Diff line
@@ -504,8 +504,7 @@ extern void unregister_cld_notifier(void); 
extern void nfsd4_ssc_init_umount_work(struct nfsd_net *nn);

#endif



extern int nfsd4_init_leases_net(struct nfsd_net *nn);

extern void nfsd4_leases_net_shutdown(struct nfsd_net *nn);

extern void nfsd4_init_leases_net(struct nfsd_net *nn);



#else /* CONFIG_NFSD_V4 */

static inline int nfsd4_is_junction(struct dentry *dentry)
@@ -513,8 +512,7 @@ static inline int nfsd4_is_junction(struct dentry *dentry) 
	return 0;

}



static inline int nfsd4_init_leases_net(struct nfsd_net *nn) { return 0; };

static inline void nfsd4_leases_net_shutdown(struct nfsd_net *nn) {};

static inline void nfsd4_init_leases_net(struct nfsd_net *nn) { };



#define register_cld_notifier() 0

#define unregister_cld_notifier() do { } while(0)