Patch "SUNRPC: double free xprt_ctxt while still in use" has been added to the 6.3-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    SUNRPC: double free xprt_ctxt while still in use

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sunrpc-double-free-xprt_ctxt-while-still-in-use.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d88b576116c7b542303ada58b5ef8482758d2783
Author: NeilBrown <neilb@xxxxxxx>
Date:   Tue May 9 09:41:49 2023 +1000

    SUNRPC: double free xprt_ctxt while still in use
    
    [ Upstream commit eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1 ]
    
    When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out
    of the svc_rqst into the svc_deferred_req.
    When the deferred request is revisited, the pointer is copied into
    the new svc_rqst - and also remains in the svc_deferred_req.
    
    In the (rare?) case that the request is deferred a second time, the old
    svc_deferred_req is reused - it still has all the correct content.
    However in that case the rq_xprt_ctxt pointer is NOT cleared so that
    when xpo_release_xprt is called, the ctxt is freed (UDP) or possible
    added to a free list (RDMA).
    When the deferred request is revisited for a second time, it will
    reference this ctxt which may be invalid, and the free the object a
    second time which is likely to oops.
    
    So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that
    the value is now stored in the svc_deferred_req.
    
    Fixes: 773f91b2cf3f ("SUNRPC: Fix NFSD's request deferral on RDMA transports")
    Signed-off-by: NeilBrown <neilb@xxxxxxx>
    Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ba629297da4e2..feab34db870fe 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1224,13 +1224,14 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
 		dr->daddr = rqstp->rq_daddr;
 		dr->argslen = rqstp->rq_arg.len >> 2;
 		dr->xprt_ctxt = rqstp->rq_xprt_ctxt;
-		rqstp->rq_xprt_ctxt = NULL;
 
 		/* back up head to the start of the buffer and copy */
 		skip = rqstp->rq_arg.len - rqstp->rq_arg.head[0].iov_len;
 		memcpy(dr->args, rqstp->rq_arg.head[0].iov_base - skip,
 		       dr->argslen << 2);
 	}
+	WARN_ON_ONCE(rqstp->rq_xprt_ctxt != dr->xprt_ctxt);
+	rqstp->rq_xprt_ctxt = NULL;
 	trace_svc_defer(rqstp);
 	svc_xprt_get(rqstp->rq_xprt);
 	dr->xprt = rqstp->rq_xprt;