Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs/nfsd
History
Li Lingfeng a7d5a90335 nfsd: return -EINVAL when namelen is 0 
[ Upstream commit 22451a16b7ab7debefce660672566be887db1637 ]

When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may
result in namelen being 0, which will cause memdup_user() to return
ZERO_SIZE_PTR.
When we access the name.data that has been assigned the value of
ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is
triggered.

[ T1205] ==================================================================
[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260
[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205
[ T1205]
[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406
[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[ T1205] Call Trace:
[ T1205]  dump_stack+0x9a/0xd0
[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  __kasan_report.cold+0x34/0x84
[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  kasan_report+0x3a/0x50
[ T1205]  nfs4_client_to_reclaim+0xe9/0x260
[ T1205]  ? nfsd4_release_lockowner+0x410/0x410
[ T1205]  cld_pipe_downcall+0x5ca/0x760
[ T1205]  ? nfsd4_cld_tracking_exit+0x1d0/0x1d0
[ T1205]  ? down_write_killable_nested+0x170/0x170
[ T1205]  ? avc_policy_seqno+0x28/0x40
[ T1205]  ? selinux_file_permission+0x1b4/0x1e0
[ T1205]  rpc_pipe_write+0x84/0xb0
[ T1205]  vfs_write+0x143/0x520
[ T1205]  ksys_write+0xc9/0x170
[ T1205]  ? __ia32_sys_read+0x50/0x50
[ T1205]  ? ktime_get_coarse_real_ts64+0xfe/0x110
[ T1205]  ? ktime_get_coarse_real_ts64+0xa2/0x110
[ T1205]  do_syscall_64+0x33/0x40
[ T1205]  entry_SYSCALL_64_after_hwframe+0x67/0xd1
[ T1205] RIP: 0033:0x7fdbdb761bc7
[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514
[ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7
[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008
[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001
[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b
[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000
[ T1205] ==================================================================

Fix it by checking namelen.

Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 74725959c33c ("nfsd: un-deprecate nfsdcld")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Scott Mayhew <smayhew@redhat.com>
Tested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-23 23:21:26 +01:00
..
acl.h NFSD: add posix ACLs to struct nfsd_attrs 2024-11-19 12:28:04 +01:00
auth.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
auth.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
blocklayout.c nfsd: move nfserrno() to vfs.c 2024-11-19 12:28:26 +01:00
blocklayoutxdr.c nfsd: move nfserrno() to vfs.c 2024-11-19 12:28:26 +01:00
blocklayoutxdr.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cache.h nfsd: make all of the nfsd stats per-network namespace 2024-11-23 23:21:02 +01:00
current_stateid.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
export.c NFSD: Fix frame size warning in svc_export_parse() 2024-11-23 23:21:02 +01:00
export.h NFSD: Fix frame size warning in svc_export_parse() 2024-11-23 23:21:02 +01:00
fault_inject.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filecache.c nfsd: fix refcount leak when file is unhashed after being found 2024-11-23 23:21:25 +01:00
filecache.h NFSD: Convert filecache to rhltable 2024-11-19 12:28:32 +01:00
flexfilelayout.c nfsd: move nfserrno() to vfs.c 2024-11-19 12:28:26 +01:00
flexfilelayoutxdr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
flexfilelayoutxdr.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
idmap.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig nfsd: allow disabling NFSv2 at compile time 2024-11-19 12:28:26 +01:00
lockd.c Keep read and write fds with each nlm_file 2024-11-19 12:27:44 +01:00
Makefile nfsd: allow disabling NFSv2 at compile time 2024-11-19 12:28:26 +01:00
netns.h nfsd: make svc_stat per-network namespace instead of global 2024-11-23 23:21:02 +01:00
nfs2acl.c NFSD: Finish converting the NFSv2 GETACL result encoder 2024-11-19 12:28:26 +01:00
nfs3acl.c NFSD: Finish converting the NFSv3 GETACL result encoder 2024-11-19 12:28:26 +01:00
nfs3proc.c NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection 2024-11-19 12:28:26 +01:00
nfs3xdr.c NFSD: Clean up WRITE arg decoders 2024-11-19 12:28:23 +01:00
nfs4acl.c NFSD: add posix ACLs to struct nfsd_attrs 2024-11-19 12:28:04 +01:00
nfs4callback.c NFSD: add support for sending CB_RECALL_ANY 2024-11-19 12:28:29 +01:00
nfs4idmap.c nfsd: call cache_put if xdr_reserve_space returns NULL 2024-11-23 23:21:26 +01:00
nfs4layouts.c NFSD: Add tracepoints to report NFSv4 callback completions 2024-11-19 12:28:22 +01:00
nfs4proc.c nfsd: make all of the nfsd stats per-network namespace 2024-11-23 23:21:02 +01:00
nfs4recover.c nfsd: return -EINVAL when namelen is 0 2024-11-23 23:21:26 +01:00
nfs4state.c nfsd: hold a lighter-weight client reference over CB_RECALL_ANY 2024-11-19 14:19:31 +01:00
nfs4xdr.c nfsd: Fix creation time serialization order 2024-11-19 12:28:32 +01:00
nfscache.c nfsd: make all of the nfsd stats per-network namespace 2024-11-23 23:21:02 +01:00
nfsctl.c nfsd: make svc_stat per-network namespace instead of global 2024-11-23 23:21:02 +01:00
nfsd.h nfsd: remove nfsd_stats, make th_cnt a global counter 2024-11-23 23:21:02 +01:00
nfsfh.c nfsd: make all of the nfsd stats per-network namespace 2024-11-23 23:21:02 +01:00
nfsfh.h NFSD: Use const pointers as parameters to fh_ helpers 2024-11-19 12:28:27 +01:00
nfsproc.c NFSD: Use set_bit(RQ_DROPME) 2024-11-19 12:28:29 +01:00
nfssvc.c nfsd: make svc_stat per-network namespace instead of global 2024-11-23 23:21:02 +01:00
nfsxdr.c NFSD: Clean up WRITE arg decoders 2024-11-19 12:28:23 +01:00
pnfs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
state.h NFSD: add delegation reaper to react to low memory condition 2024-11-19 12:28:29 +01:00
stats.c nfsd: make svc_stat per-network namespace instead of global 2024-11-23 23:21:02 +01:00
stats.h nfsd: make svc_stat per-network namespace instead of global 2024-11-23 23:21:02 +01:00
trace.c NFSD: Add SPDX header for fs/nfsd/trace.c 2024-11-19 12:27:20 +01:00
trace.h NFSD: Replace nfsd_prune_bucket() 2024-11-23 23:21:01 +01:00
vfs.c nfsd: make all of the nfsd stats per-network namespace 2024-11-23 23:21:02 +01:00
vfs.h NFSD: Pass the target nfsd_file to nfsd_commit() 2024-11-19 12:28:26 +01:00
xdr.h SUNRPC: Change return value type of .pc_encode 2024-11-19 12:27:48 +01:00
xdr3.h SUNRPC: Change return value type of .pc_encode 2024-11-19 12:27:48 +01:00
xdr4.h NFSD: enhance inter-server copy cleanup 2024-11-19 12:28:30 +01:00
xdr4cb.h NFSD: add support for sending CB_RECALL_ANY 2024-11-19 12:28:29 +01:00