• NeilBrown's avatar
    sunrpc: prevent use-after-free on clearing XPT_BUSY · ed2849d3
    NeilBrown authored
    When an xprt is created, it has a refcount of 1, and XPT_BUSY is set.
    The refcount is *not* owned by the thread that created the xprt
    (as is clear from the fact that creators never put the reference).
    Rather, it is owned by the absence of XPT_DEAD.  Once XPT_DEAD is set,
    (And XPT_BUSY is clear) that initial reference is dropped and the xprt
    can be freed.
    
    So when a creator clears XPT_BUSY it is dropping its only reference and
    so must not touch the xprt again.
    
    However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY
    reference on a new xprt), calls svc_xprt_recieved.  This clears
    XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.
    This is dangerous and has been seen to leave svc_xprt_enqueue working
    with an xprt containing garbage.
    
    So we need to hold an extra counted reference over that call to
    svc_xprt_received.
    
    For safety, any time we clear XPT_BUSY and then use the xprt again, we
    first get a reference, and the put it again afterwards.
    
    Note that svc_close_all does not need this extra protection as there are
    no threads running, and the final free can only be called asynchronously
    from such a thread.
    Signed-off-by: default avatarNeilBrown <neilb@suse.de>
    Cc: stable@kernel.org
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    ed2849d3
svc_xprt.c 33.3 KB