Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net
History
felix 00cb8726fb SUNRPC: Fix RPC client cleaned up the freed pipefs dentries 
[ Upstream commit bfca5fb4e97c46503ddfc582335917b0cc228264 ]

RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()
workqueue,which takes care about pipefs superblock locking.
In some special scenarios, when kernel frees the pipefs sb of the
current client and immediately alloctes a new pipefs sb,
rpc_remove_pipedir function would misjudge the existence of pipefs
sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.

To fix this issue, rpc_remove_pipedir should check whether the
current pipefs sb is consistent with the original pipefs sb.

This error can be catched by KASAN:
=========================================================
[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200
[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503
[  250.500549] Workqueue: events rpc_free_client_work
[  250.501001] Call Trace:
[  250.502880]  kasan_report+0xb6/0xf0
[  250.503209]  ? dget_parent+0x195/0x200
[  250.503561]  dget_parent+0x195/0x200
[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10
[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90
[  250.504781]  rpc_remove_client_dir+0xf5/0x150
[  250.505195]  rpc_free_client_work+0xe4/0x230
[  250.505598]  process_one_work+0x8ee/0x13b0
...
[   22.039056] Allocated by task 244:
[   22.039390]  kasan_save_stack+0x22/0x50
[   22.039758]  kasan_set_track+0x25/0x30
[   22.040109]  __kasan_slab_alloc+0x59/0x70
[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240
[   22.040889]  __d_alloc+0x31/0x8e0
[   22.041207]  d_alloc+0x44/0x1f0
[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140
[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110
[   22.042459]  rpc_create_client_dir+0x34/0x150
[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0
[   22.043284]  rpc_client_register+0x136/0x4e0
[   22.043689]  rpc_new_client+0x911/0x1020
[   22.044057]  rpc_create_xprt+0xcb/0x370
[   22.044417]  rpc_create+0x36b/0x6c0
...
[   22.049524] Freed by task 0:
[   22.049803]  kasan_save_stack+0x22/0x50
[   22.050165]  kasan_set_track+0x25/0x30
[   22.050520]  kasan_save_free_info+0x2b/0x50
[   22.050921]  __kasan_slab_free+0x10e/0x1a0
[   22.051306]  kmem_cache_free+0xa5/0x390
[   22.051667]  rcu_core+0x62c/0x1930
[   22.051995]  __do_softirq+0x165/0x52a
[   22.052347]
[   22.052503] Last potentially related work creation:
[   22.052952]  kasan_save_stack+0x22/0x50
[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0
[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0
[   22.054209]  dentry_free+0xb2/0x140
[   22.054540]  __dentry_kill+0x3be/0x540
[   22.054900]  shrink_dentry_list+0x199/0x510
[   22.055293]  shrink_dcache_parent+0x190/0x240
[   22.055703]  do_one_tree+0x11/0x40
[   22.056028]  shrink_dcache_for_umount+0x61/0x140
[   22.056461]  generic_shutdown_super+0x70/0x590
[   22.056879]  kill_anon_super+0x3a/0x60
[   22.057234]  rpc_kill_sb+0x121/0x200

Fixes: 0157d021d23a ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines")
Signed-off-by: felix <fuzhen5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 11:43:19 +01:00
..
6lowpan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
9p 9p/trans_fd: Annotate data-racy writes to file::f_flags 2024-11-18 11:43:14 +01:00
802 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
8021q Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
appletalk Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
atm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ax25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
batman-adv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bluetooth Bluetooth: Fix double free in hci_conn_cleanup 2024-11-18 11:43:12 +01:00
bpf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpfilter Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bridge Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
caif Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
can can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior 2024-11-18 10:58:47 +01:00
ceph libceph: use kernel_connect() 2024-11-08 11:25:50 +01:00
core net: annotate data-races around sk->sk_dst_pending_confirm 2024-11-18 11:43:12 +01:00
dcb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2024-11-18 11:43:07 +01:00
decnet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dns_resolver Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dsa Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethernet Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethtool Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hsr hsr: Prevent use after free in prp_create_tagged_frame() 2024-11-18 11:43:07 +01:00
ieee802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ife Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipv4 net: annotate data-races around sk->sk_dst_pending_confirm 2024-11-18 11:43:12 +01:00
ipv6 dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2024-11-18 11:43:07 +01:00
iucv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
key Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l2tp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l3mdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lapb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
llc llc: verify mac len before reading mac header 2024-11-18 11:43:07 +01:00
mac80211 wifi: mac80211: don't return unset power in ieee80211_get_tx_power() 2024-11-18 11:43:12 +01:00
mac802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mptcp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ncm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ncsi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netfilter netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses 2024-11-18 11:43:11 +01:00
netlabel Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netlink Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netrom Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfc nfc: nci: fix possible NULL pointer dereference in send_acknowledge() 2024-11-08 11:26:08 +01:00
nsh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openvswitch Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
packet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
phonet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
psample Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qrtr Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rds net: prevent address rewrite in kernel_bind() 2024-11-08 11:25:44 +01:00
rfkill net: rfkill: gpio: prevent value glitch during probe 2024-11-08 11:26:10 +01:00
rose Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rxrpc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sched net: sched: cls_u32: Fix allocation size in u32_init() 2024-11-18 10:58:46 +01:00
sctp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
skb_tracer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smc net/smc: put sk reference if close work was canceled 2024-11-18 11:43:08 +01:00
strparser Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sunrpc SUNRPC: Fix RPC client cleaned up the freed pipefs dentries 2024-11-18 11:43:19 +01:00
switchdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tipc tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING 2024-11-18 11:43:07 +01:00
tls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vmw_vsock Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wimax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wireless wifi: cfg80211: avoid leaking stack data into trace 2024-11-08 11:26:17 +01:00
x25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xdp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm Revert "xfrm: fix a data-race in xfrm_gen_index()" 2024-11-17 19:38:56 +01:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devres.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
socket.c net: prevent address rewrite in kernel_bind() 2024-11-08 11:25:44 +01:00
sysctl_net.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
TEST_MAPPING Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00