From nobody Thu Dec 18 06:14:33 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73170C4332F for ; Mon, 11 Dec 2023 20:35:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344440AbjLKUfc (ORCPT ); Mon, 11 Dec 2023 15:35:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229539AbjLKUfb (ORCPT ); Mon, 11 Dec 2023 15:35:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 797F2DC for ; Mon, 11 Dec 2023 12:35:37 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C4ACC433C7; Mon, 11 Dec 2023 20:35:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702326937; bh=eDm/y62JAKrz0cnaMduV/pGoRHEvmpfUfoMirIKzVEU=; h=From:Date:Subject:To:Cc:From; b=JrhX+MXpTRpYaOST9R/yuZSXwDl9tuf7nKtHTz6AWVeIJXRzPb3ARe124YvzZA/oz bYGxsG97qEHKnmn2fBkV5AM1x2F7WDL7cVb5jimhcOVjjANWwdYTa+y45V1PsxX8Zd axKSM2jb740MVyGJF+zv8Tj+fAFiGwWpMIxk5XbMUkMmqv1iD4ERAA1337EevYzKEk kP8p5MY/otvgBhTUAjaFY5DElNmBgqeN+xJeiau4XSGB7F/33naBidr9i3z9ufRZtP QOayeDJrbs4YtarEJ4u4/C4T8YKulmEU46YKtNNoJz4zRMIbH7NYK/JiA1KZ5W6Woy sluuHLeREl9cA== From: Jeff Layton Date: Mon, 11 Dec 2023 15:35:30 -0500 Subject: [PATCH] nfsd: properly tear down server when write_ports fails MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20231211-nfsd-fixes-v1-1-c87a802f4977@kernel.org> X-B4-Tracking: v=1; b=H4sIAJFyd2UC/x2LQQqAMAzAvjJ6dmArIvoV8SBrp71MWUGEsb87P IYkBUyyisHiCmR51PRKDbBzEM49HeKVGwP1NCAh+hSNfdRXzPMcCXkMSDxBG+4sv2j9utX6ASG aVHdcAAAA To: Chuck Lever , Neil Brown , Olga Kornievskaia , Dai Ngo , Tom Talpey Cc: linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, Zhi Li , Jeff Layton X-Mailer: b4 0.12.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=4975; i=jlayton@kernel.org; h=from:subject:message-id; bh=eDm/y62JAKrz0cnaMduV/pGoRHEvmpfUfoMirIKzVEU=; b=owEBbQKS/ZANAwAIAQAOaEEZVoIVAcsmYgBld3KX1EvNgC2UdnMV+0GXDrCsdCTFcKk0KZjZ2 n5aR5HkPUaJAjMEAAEIAB0WIQRLwNeyRHGyoYTq9dMADmhBGVaCFQUCZXdylwAKCRAADmhBGVaC FaEMEACVsXytDzQkJ9NWp8Rd2G/uyS7dDh7u0ji+RXjDx1TZULc+bQUvcSU3xqAH2mIUhGl1kTZ EeDWQJ6XkJH45j5/C8eHSWe9NZoh5K0Z7gJIrJl23YQMBv3y1o/JEg5BIlg4ZvfA01rN1i6ufrh gN468CpPBkkuJ4gU2b5G6tQ1qG+nL1ne5Tclo91lfhaN9CWnK8whwNfACCpouOJAYESVkfJIoJz CsgnrVeFkwpLU5RRvv4NNKkgjoPgtV+w7VjpXTZbFIfb27sa72MKsoeYtcH+6+xK4hiJLkuc+rB iVImMZyX9K58U9PfXX/FFXo/k79AY4kof9T/BF7SIHftLiMjRc/T4782YH+hYbWZ3RSza8x1Z1Z zTOJjWxVXcibxApnfrYCiJgwAQODxtTmBooA2nwQvtOytUqBxg2TQ/0z93iAo7SyfRd/9Fn37D/ 8R0z4N59v3blIDsOhDFwRUfJ9QQaeMMNEHJ9wYTPf1zMxnSUREbePIeKr8IMtU1RIUsDHCLIJsB miZfdyB14yei75jNvBGAzNw/iLSII5LdgSesMPMvsVV0wb8y+5YSpYDdEIlsePC69g2OjlS+R/3 8pxRfwm4ty/v69Zj8IMdOj9ERzpvWm8CKigHc++qJUeLfDDAjFzg18NtefQHXQQU+NNtJlOkV+A k5rUPocfc5lL59g== X-Developer-Key: i=jlayton@kernel.org; a=openpgp; fpr=4BC0D7B24471B2A184EAF5D3000E684119568215 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When the initial write to the "portlist" file fails, we'll currently put the reference to the nn->nfsd_serv, but leave the pointer intact. This leads to a UAF if someone tries to write to "portlist" again. Simple reproducer, from a host with nfsd shut down: # echo "foo 2049" > /proc/fs/nfsd/portlist # echo "foo 2049" > /proc/fs/nfsd/portlist The kernel will oops on the second one when it trips over the dangling nn->nfsd_serv pointer. There is a similar bug in __write_ports_addfd. This patch fixes it by adding some extra logic to nfsd_put to ensure that nfsd_last_thread is called prior to putting the reference when the conditions are right. Fixes: 9f28a971ee9f ("nfsd: separate nfsd_last_thread() from nfsd_put()") Closes: https://issues.redhat.com/browse/RHEL-19081 Reported-by: Zhi Li Signed-off-by: Jeff Layton --- This should probably go to stable, but we'll need to backport for v6.6 since older kernels don't have nfsd_nl_rpc_status_get_done. We should just be able to drop that hunk though. --- fs/nfsd/nfsctl.c | 32 ++++++++++++++++++++++++++++---- fs/nfsd/nfsd.h | 8 +------- fs/nfsd/nfssvc.c | 2 +- 3 files changed, 30 insertions(+), 12 deletions(-) diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 3e15b72f421d..1ceccf804e44 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -61,6 +61,30 @@ enum { NFSD_MaxReserved }; =20 +/** + * nfsd_put - put the reference to the nfsd_serv for given net + * @net: the net namespace for the serv + * @err: current error for the op + * + * When putting a reference to the nfsd_serv from a control operation + * we must first call nfsd_last_thread if all of these are true: + * + * - the configuration operation is going fail + * - there are no running threads + * - there are no successfully configured ports + * + * Otherwise, just put the serv reference. + */ +static inline void nfsd_put(struct net *net, int err) +{ + struct nfsd_net *nn =3D net_generic(net, nfsd_net_id); + struct svc_serv *serv =3D nn->nfsd_serv; + + if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) + nfsd_last_thread(net); + svc_put(serv); +} + /* * write() for these nodes. */ @@ -709,7 +733,7 @@ static ssize_t __write_ports_addfd(char *buf, struct ne= t *net, const struct cred !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) svc_get(nn->nfsd_serv); =20 - nfsd_put(net); + nfsd_put(net, err); return err; } =20 @@ -748,7 +772,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct = net *net, const struct cr if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) svc_get(nn->nfsd_serv); =20 - nfsd_put(net); + nfsd_put(net, 0); return 0; out_close: xprt =3D svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port); @@ -757,7 +781,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct = net *net, const struct cr svc_xprt_put(xprt); } out_err: - nfsd_put(net); + nfsd_put(net, err); return err; } =20 @@ -1687,7 +1711,7 @@ int nfsd_nl_rpc_status_get_dumpit(struct sk_buff *skb, int nfsd_nl_rpc_status_get_done(struct netlink_callback *cb) { mutex_lock(&nfsd_mutex); - nfsd_put(sock_net(cb->skb->sk)); + nfsd_put(sock_net(cb->skb->sk), 0); mutex_unlock(&nfsd_mutex); =20 return 0; diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h index f5ff42f41ee7..3aa8cd2c19ac 100644 --- a/fs/nfsd/nfsd.h +++ b/fs/nfsd/nfsd.h @@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file = *); int nfsd_pool_stats_release(struct inode *, struct file *); void nfsd_shutdown_threads(struct net *net); =20 -static inline void nfsd_put(struct net *net) -{ - struct nfsd_net *nn =3D net_generic(net, nfsd_net_id); - - svc_put(nn->nfsd_serv); -} - bool i_am_nfsd(void); =20 struct nfsdfs_client { @@ -153,6 +146,7 @@ struct nfsd_net; enum vers_op {NFSD_SET, NFSD_CLEAR, NFSD_TEST, NFSD_AVAIL }; int nfsd_vers(struct nfsd_net *nn, int vers, enum vers_op change); int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op = change); +void nfsd_last_thread(struct net *net); void nfsd_reset_versions(struct nfsd_net *nn); int nfsd_create_serv(struct net *net); =20 diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c index fe61d9bbcc1f..d6939e23ffcf 100644 --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -542,7 +542,7 @@ static struct notifier_block nfsd_inet6addr_notifier = =3D { /* Only used under nfsd_mutex, so this atomic may be overkill: */ static atomic_t nfsd_notifier_refcount =3D ATOMIC_INIT(0); =20 -static void nfsd_last_thread(struct net *net) +void nfsd_last_thread(struct net *net) { struct nfsd_net *nn =3D net_generic(net, nfsd_net_id); struct svc_serv *serv =3D nn->nfsd_serv; --- base-commit: a39b6ac3781d46ba18193c9dbb2110f31e9bffe9 change-id: 20231211-nfsd-fixes-d9f21d5c12d7 Best regards, --=20 Jeff Layton