On 02/07/2018 03:20 PM, Trond Myklebust wrote:
On Wed, 2018-02-07 at 16:07 -0500, Trond Myklebust wrote:
Hi Bill,
On Wed, 2018-02-07 at 14:53 -0600, Bill Baker wrote:
nfs4_update_server unconditionally releases the nfs_client for the
source server. If migration fails, this can cause the source
server's
nfs_client struct to be left with a low reference count, resulting
in
use-after-free.
<snip>
That looks almost right. Isn't there now a reference leak if
nfs4_set_client() returns -ELOOP? I think that is really down to an
existing bug in nfs4_set_client() rather than in your fix, however
Sorry... I should probably have been more explicit about where the bug
is: nfs4_set_client() should probably be calling nfs_put_client() on
its copy of 'clp' before returning -ELOOP.
the
fix does re-expose that bug.
By which I mean that the two bugs currently cancel each other out for
the case of ELOOP. By fixing one bug, but not the other, we're undoing
the cancellation... ☺
Hi Trond,
Thank you for your quick feedback, let me go do some more inspection.
--
Bill Baker - Oracle Linux NFS
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
