On Mon, Oct 21, 2024 at 10:23:41PM +0800, Yang Erkun wrote:
> From: Yang Erkun <yangerkun@xxxxxxxxxx>
>
> The function `e_show` was called with protection from RCU. This only
> ensures that `exp` will not be freed. Therefore, the reference count for
> `exp` can drop to zero, which will trigger a refcount use-after-free
> warning when `exp_get` is called. To resolve this issue, use
> `cache_get_rcu` to ensure that `exp` remains active.
>
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 3 PID: 819 at lib/refcount.c:25
> refcount_warn_saturate+0xb1/0x120
> CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.16.1-2.fc37 04/01/2014
> RIP: 0010:refcount_warn_saturate+0xb1/0x120
> ...
> Call Trace:
> <TASK>
> e_show+0x20b/0x230 [nfsd]
> seq_read_iter+0x589/0x770
> seq_read+0x1e5/0x270
> vfs_read+0x125/0x530
> ksys_read+0xc1/0x160
> do_syscall_64+0x5f/0x170
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
This seems better:
Fixes: bf18f163e89c ("NFSD: Using exp_get for export getting")
Cc: stable@xxxxxxxxxxxxxxx # 4.20+
> Signed-off-by: Yang Erkun <yangerkun@xxxxxxxxxx>
> ---
> fs/nfsd/export.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
> index c82d8e3e0d4f..49aede376d86 100644
> --- a/fs/nfsd/export.c
> +++ b/fs/nfsd/export.c
> @@ -1406,9 +1406,12 @@ static int e_show(struct seq_file *m, void *p)
> return 0;
> }
>
> - exp_get(exp);
> + if (!cache_get_rcu(&exp->h))
> + return 0;
> +
> if (cache_check(cd, &exp->h, NULL))
> return 0;
> +
> exp_put(exp);
> return svc_export_show(m, cd, cp);
> }
> --
> 2.39.2
>
--
Chuck Lever
