J. Bruce Fields 33645d3e22 nfsd: fix use-after-free due to delegation race ... commit 548ec0805c upstream. A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f45 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com> [Salvatore Bonaccorso: Backport for context changes to versions which do not have 20b7d86f29 ("nfsd: use boottime for lease expiry calculation")] Signed-off-by: Salvatore Bonaccorso <carnil@debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-22 09:17:59 +01:00
..
acl.h
auth.c
auth.h
blocklayout.c
blocklayoutxdr.c
blocklayoutxdr.h
cache.h
current_stateid.h
export.c
export.h
fault_inject.c
flexfilelayout.c
flexfilelayoutxdr.c
flexfilelayoutxdr.h
idmap.h
Kconfig
lockd.c
Makefile
netns.h
nfs2acl.c
nfs3acl.c
nfs3proc.c	nfsd: fix memory corruption caused by readdir	2019-03-23 14:35:28 +01:00
nfs3xdr.c	nfsd4: readdirplus shouldn't return parent of export	2021-01-23 15:48:45 +01:00
nfs4acl.c
nfs4callback.c	nfsd: Fix svc_xprt refcnt leak when setup callback client failed	2020-06-25 15:41:49 +02:00
nfs4idmap.c
nfs4layouts.c	nfsd: fix delay timer on 32-bit architectures	2020-02-14 16:32:17 -05:00
nfs4proc.c
nfs4recover.c	nfsd: fix a warning in __cld_pipe_upcall()	2019-12-17 20:38:18 +01:00
nfs4state.c	nfsd: fix use-after-free due to delegation race	2021-12-22 09:17:59 +01:00
nfs4xdr.c	nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero	2021-10-17 10:08:32 +02:00
nfscache.c
nfsctl.c	NFSD: Keep existing listeners on portlist error	2021-10-27 09:51:39 +02:00
nfsd.h
nfsfh.c
nfsfh.h
nfsproc.c	NFSD: Add missing NFSv2 .pc_func methods	2020-11-05 11:07:02 +01:00
nfssvc.c	nfsd: Fix message level for normal termination	2020-12-29 13:47:00 +01:00
nfsxdr.c
pnfs.h
state.h	nfsd: fix jiffies/time_t mixup in LRU list	2020-02-14 16:32:17 -05:00
stats.c
stats.h
trace.c
trace.h
vfs.c	nfsd: apply umask on fs without ACL support	2020-07-09 09:36:31 +02:00
vfs.h	nfsd: allow fh_want_write to be called twice	2019-06-15 11:54:54 +02:00
xdr.h
xdr3.h
xdr4.h
xdr4cb.h