From: Yang Erkun <yangerkun@xxxxxxxxxx>
After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with
rcu_work"), svc_export_put/expkey_put will call path_put with async
mode. This can lead some unexpected failure:
mkdir /mnt/sda
mkfs.xfs -f /dev/sda
echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports
echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports
exportfs -ra
service nfs-server start
mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1
mount /dev/sda /mnt/sda
touch /mnt1/sda/file
exportfs -r
umount /mnt/sda # failed unexcepted
The touch above will finally call nfsd_cross_mnt, add refcount to mount,
and then add cache_head. Before this commit, exportfs -r will call
cache_flush to cleanup all cache_head, and path_put in
svc_export_put/expkey_put will be finished with sync mode. So, the
latter umount will always success. However, after this commit, path_put
will be called with async mode, the latter umount may failed, and if we
add some delay, umount will success too. Personally I think this bug and
should be fixed. We first revert before bugfix patch, and then fix the
original bug with a different way.
Yang Erkun (5):
nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work"
SUNRPC: move cache_put out from cache_check
nfsd: no need get cache ref when protected by rcu
SUNRPC: no need get cache ref when protected by rcu
nfsd: fix UAF when access ex_uuid or ex_stats
fs/nfs/dns_resolve.c | 4 +++-
fs/nfsd/export.c | 34 ++++++++++---------------------
fs/nfsd/export.h | 4 ++--
fs/nfsd/nfs4idmap.c | 2 ++
net/sunrpc/auth_gss/svcauth_gss.c | 9 ++++++--
net/sunrpc/cache.c | 11 ++--------
net/sunrpc/svcauth_unix.c | 12 ++++++++++-
7 files changed, 38 insertions(+), 38 deletions(-)
--
2.39.2
