user/sven/linux.git/include/linux/sunrpc/svc.h, branch v4.9.155

sunrpc: use-after-free in svc_process_common()

2019-01-16T21:12:33Z

commit d4b09acf924b84bae77cad090a9d108e70b43643 upstream. if node have NFSv41+ mounts inside several net namespaces it can lead to use-after-free in svc_process_common() svc_process_common() /* Setup reply header */ rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE svc_process_common() can use incorrect rqstp->rq_xprt, its caller function bc_svc_process() takes it from serv->sv_bc_xprt. The problem is that serv is global structure but sv_bc_xprt is assigned per-netnamespace. According to Trond, the whole "let's set up rqstp->rq_xprt for the back channel" is nothing but a giant hack in order to work around the fact that svc_process_common() uses it to find the xpt_ops, and perform a couple of (meaningless for the back channel) tests of xpt_flags. All we really need in svc_process_common() is to be able to run rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr() Bruce J Fields points that this xpo_prep_reply_hdr() call is an awfully roundabout way just to do "svc_putnl(resv, 0);" in the tcp case. This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(), now it calls svc_process_common() with rqstp->rq_xprt = NULL. To adjust reply header svc_process_common() just check rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case. To handle rqstp->rq_xprt = NULL case in functions called from svc_process_common() patch intruduces net namespace pointer svc_rqst->rq_bc_net and adjust SVC_NET() definition. Some other function was also adopted to properly handle described case. Signed-off-by: Vasily Averin Cc: stable@vger.kernel.org Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup") Signed-off-by: J. Bruce Fields v2: - added lost extern svc_tcp_prep_reply_hdr() - dropped trace_svc_process() changes - context fixes in svc_process_common() Signed-off-by: Vasily Averin Signed-off-by: Greg Kroah-Hartman

NFSv4: Fix callback server shutdown

2017-09-27T12:39:18Z

commit ed6473ddc704a2005b9900ca08e236ebb2d8540a upstream. We want to use kthread_stop() in order to ensure the threads are shut down before we tear down the nfs_callback_info in nfs_callback_down. Tested-and-reviewed-by: Kinglong Mee Reported-by: Kinglong Mee Fixes: bb6aeba736ba9 ("NFSv4.x: Switch to using svc_set_num_threads()...") Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields Cc: Jan Hudoba Signed-off-by: Greg Kroah-Hartman

SUNRPC: Add a server side per-connection limit

2016-07-13T19:53:48Z

Allow the user to limit the number of requests serviced through a single connection, to help prevent faster clients from starving slower clients. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields

mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage

2016-04-04T17:41:08Z

Mostly direct substitution with occasional adjustment or removing outdated comments. Signed-off-by: Kirill A. Shutemov Acked-by: Michal Hocko Signed-off-by: Linus Torvalds

nfsd/sunrpc: factor svc_rqst allocation and freeing from sv_nrthreads refcounting

2015-08-10T20:05:44Z

In later patches, we'll want to be able to allocate and free svc_rqst structures without monkeying with the serv->sv_nrthreads refcount. Factor those pieces out of their respective functions. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields

nfsd/sunrpc: move pool_mode definitions into svc.h

2015-08-10T20:05:43Z

In later patches, we're going to need to allow code external to svc.c to figure out what pool_mode is in use. Move these definitions into svc.h to prepare for that. Also, make the svc_pool_map object available and exported so that other modules can peek in there to get insight into what pool mode is in use. Likewise, export svc_pool_map_get/put function to make it safe to do so. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields

nfsd/sunrpc: abstract out svc_set_num_threads to sv_ops

2015-08-10T20:05:43Z

Add an operation that will do setup of the service. In the case of a classic thread-based service that means starting up threads. In the case of a workqueue-based service, the setup will do something different. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields

nfsd/sunrpc: turn enqueueing a svc_xprt into a svc_serv operation

2015-08-10T20:05:42Z

For now, all services use svc_xprt_do_enqueue, but once we add workqueue-based service support, we'll need to do something different. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields

nfsd/sunrpc: move sv_module parm into sv_ops

2015-08-10T20:05:41Z

...not technically an operation, but it's more convenient and cleaner to pass the module pointer in this struct. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields

nfsd/sunrpc: move sv_function into sv_ops

2015-08-10T20:05:41Z

Since we now have a container for holding svc_serv operations, move the sv_function into it as well. Signed-off-by: Shirley Ma Acked-by: Jeff Layton Tested-by: Shirley Ma Signed-off-by: J. Bruce Fields