Skip to contentSkip to conversation

Patch "nfs4: have do_vfs_lock take an inode pointer" has been added to the 4.1-stable tree

PATCH [email protected] 1 participant 1 message Oct 23, 2015

Subsystems (2)
Stable branch NFS client
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

nfs4: have do_vfs_lock take an inode pointer

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfs4-have-do_vfs_lock-take-an-inode-pointer.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 83bfff23e9ed19f37c4ef0bba84e75bd88e5cf21 Mon Sep 17 00:00:00 2001

From: Jeff Layton <[email protected]>
Date: Sat, 11 Jul 2015 06:43:03 -0400
Subject: nfs4: have do_vfs_lock take an inode pointer

From: Jeff Layton <[email protected]>

commit 83bfff23e9ed19f37c4ef0bba84e75bd88e5cf21 upstream.

Now that we have file locking helpers that can deal with an inode instead of a filp, we can change the NFSv4 locking code to use that instead.

This should fix the case where we have a filp that is closed while flock or OFD locks are set on it, and the task is signaled so that it doesn't wait for the LOCKU reply to come in before the filp is freed. At that point we can end up with a use-after-free with the current code, which relies on dereferencing the fl_file in the lock request.

Signed-off-by Jeff Layton <[email protected]>
Reviewed-by "J. Bruce Fields" <[email protected]>
Tested-by "J. Bruce Fields" <[email protected]>
Cc William Dauchy <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/nfs/nfs4proc.c |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)
fs/nfs/nfs4proc.c +8 -8
@@ -5367,15 +5367,15 @@ static int nfs4_proc_getlk(struct nfs4_s
 	return err;
 }
 
-static int do_vfs_lock(struct file *file, struct file_lock *fl)
+static int do_vfs_lock(struct inode *inode, struct file_lock *fl)
 {
 	int res = 0;
 	switch (fl->fl_flags & (FL_POSIX|FL_FLOCK)) {
 		case FL_POSIX:
-			res = posix_lock_file_wait(file, fl);
+			res = posix_lock_inode_wait(inode, fl);
 			break;
 		case FL_FLOCK:
-			res = flock_lock_file_wait(file, fl);
+			res = flock_lock_inode_wait(inode, fl);
 			break;
 		default:
 			BUG();

@@ -5435,7 +5435,7 @@ static void nfs4_locku_done(struct rpc_t
 	switch (task->tk_status) {
 		case 0:
 			renew_lease(calldata->server, calldata->timestamp);
-			do_vfs_lock(calldata->fl.fl_file, &calldata->fl);
+			do_vfs_lock(calldata->lsp->ls_state->inode, &calldata->fl);
 			if (nfs4_update_lock_stateid(calldata->lsp,
 					&calldata->res.stateid))
 				break;

@@ -5543,7 +5543,7 @@ static int nfs4_proc_unlck(struct nfs4_s
 	mutex_lock(&sp->so_delegreturn_mutex);
 	/* Exclude nfs4_reclaim_open_stateid() - note nesting! */
 	down_read(&nfsi->rwsem);
-	if (do_vfs_lock(request->fl_file, request) == -ENOENT) {
+	if (do_vfs_lock(inode, request) == -ENOENT) {
 		up_read(&nfsi->rwsem);
 		mutex_unlock(&sp->so_delegreturn_mutex);
 		goto out;

@@ -5684,7 +5684,7 @@ static void nfs4_lock_done(struct rpc_ta
 				data->timestamp);
 		if (data->arg.new_lock) {
 			data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
-			if (do_vfs_lock(data->fl.fl_file, &data->fl) < 0) {
+			if (do_vfs_lock(lsp->ls_state->inode, &data->fl) < 0) {
 				rpc_restart_call_prepare(task);
 				break;
 			}

@@ -5926,7 +5926,7 @@ static int _nfs4_proc_setlk(struct nfs4_
 	if (status != 0)
 		goto out;
 	request->fl_flags |= FL_ACCESS;
-	status = do_vfs_lock(request->fl_file, request);
+	status = do_vfs_lock(state->inode, request);
 	if (status < 0)
 		goto out;
 	down_read(&nfsi->rwsem);

@@ -5934,7 +5934,7 @@ static int _nfs4_proc_setlk(struct nfs4_
 		/* Yes: cache locks! */
 		/* ...but avoid races with delegation recall... */
 		request->fl_flags = fl_flags & ~FL_SLEEP;
-		status = do_vfs_lock(request->fl_file, request);
+		status = do_vfs_lock(state->inode, request);
 		up_read(&nfsi->rwsem);
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/locks-new-helpers-flock_lock_inode_wait-and-posix_lock_inode_wait.patch queue-4.1/locks-have-flock_lock_file-take-an-inode-pointer-instead-of-a-filp.patch queue-4.1/locks-inline-posix_lock_file_wait-and-flock_lock_file_wait.patch queue-4.1/nfs4-have-do_vfs_lock-take-an-inode-pointer.patch