Commit 5a67657a authored by Trond Myklebust's avatar Trond Myklebust

SUNRPC: Fix race corrupting rpc upcall

If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
after rpc_pipe_release calls rpc_purge_list(), but before it calls
gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
will free a message without deleting it from the rpci->pipe list.

We will be left with a freed object on the rpc->pipe list.  Most
frequent symptoms are kernel crashes in rpc.gssd system calls on the
pipe in question.
Reported-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@kernel.org
parent f2d47d02
...@@ -745,17 +745,18 @@ gss_pipe_release(struct inode *inode) ...@@ -745,17 +745,18 @@ gss_pipe_release(struct inode *inode)
struct rpc_inode *rpci = RPC_I(inode); struct rpc_inode *rpci = RPC_I(inode);
struct gss_upcall_msg *gss_msg; struct gss_upcall_msg *gss_msg;
restart:
spin_lock(&inode->i_lock); spin_lock(&inode->i_lock);
while (!list_empty(&rpci->in_downcall)) { list_for_each_entry(gss_msg, &rpci->in_downcall, list) {
gss_msg = list_entry(rpci->in_downcall.next, if (!list_empty(&gss_msg->msg.list))
struct gss_upcall_msg, list); continue;
gss_msg->msg.errno = -EPIPE; gss_msg->msg.errno = -EPIPE;
atomic_inc(&gss_msg->count); atomic_inc(&gss_msg->count);
__gss_unhash_msg(gss_msg); __gss_unhash_msg(gss_msg);
spin_unlock(&inode->i_lock); spin_unlock(&inode->i_lock);
gss_release_msg(gss_msg); gss_release_msg(gss_msg);
spin_lock(&inode->i_lock); goto restart;
} }
spin_unlock(&inode->i_lock); spin_unlock(&inode->i_lock);
......
...@@ -48,7 +48,7 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head, ...@@ -48,7 +48,7 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head,
return; return;
do { do {
msg = list_entry(head->next, struct rpc_pipe_msg, list); msg = list_entry(head->next, struct rpc_pipe_msg, list);
list_del(&msg->list); list_del_init(&msg->list);
msg->errno = err; msg->errno = err;
destroy_msg(msg); destroy_msg(msg);
} while (!list_empty(head)); } while (!list_empty(head));
...@@ -208,7 +208,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp) ...@@ -208,7 +208,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
if (msg != NULL) { if (msg != NULL) {
spin_lock(&inode->i_lock); spin_lock(&inode->i_lock);
msg->errno = -EAGAIN; msg->errno = -EAGAIN;
list_del(&msg->list); list_del_init(&msg->list);
spin_unlock(&inode->i_lock); spin_unlock(&inode->i_lock);
rpci->ops->destroy_msg(msg); rpci->ops->destroy_msg(msg);
} }
...@@ -268,7 +268,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset) ...@@ -268,7 +268,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
if (res < 0 || msg->len == msg->copied) { if (res < 0 || msg->len == msg->copied) {
filp->private_data = NULL; filp->private_data = NULL;
spin_lock(&inode->i_lock); spin_lock(&inode->i_lock);
list_del(&msg->list); list_del_init(&msg->list);
spin_unlock(&inode->i_lock); spin_unlock(&inode->i_lock);
rpci->ops->destroy_msg(msg); rpci->ops->destroy_msg(msg);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment