microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/fs
История
Dai Ngo 83b9496975 NFSD: fix use-after-free on source server when doing inter-server copy 
[ Upstream commit 019805fea9 ]

Use-after-free occurred when the laundromat tried to free expired
cpntf_state entry on the s2s_cp_stateids list after inter-server
copy completed. The sc_cp_list that the expired copy state was
inserted on was already freed.

When COPY completes, the Linux client normally sends LOCKU(lock_state x),
FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.
The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state
from the s2s_cp_stateids list before freeing the lock state's stid.

However, sometimes the CLOSE was sent before the FREE_STATEID request.
When this happens, the nfsd4_close_open_stateid call from nfsd4_close
frees all lock states on its st_locks list without cleaning up the copy
state on the sc_cp_list list. When the time the FREE_STATEID arrives the
server returns BAD_STATEID since the lock state was freed. This causes
the use-after-free error to occur when the laundromat tries to free
the expired cpntf_state.

This patch adds a call to nfs4_free_cpntf_statelist in
nfsd4_close_open_stateid to clean up the copy state before calling
free_ol_stateid_reaplist to free the lock state's stid on the reaplist.

Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-10-26 12:35:32 +02:00
..
9p 9p: fix a bunch of checkpatch warnings 2022-08-17 14:24:07 +02:00
adfs
…
affs
…
afs afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked 2022-09-23 14:15:51 +02:00
autofs
…
befs
…
bfs
…
btrfs btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer 2022-10-26 12:34:27 +02:00
cachefiles fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
ceph ceph: don't truncate file in atomic_open 2022-10-15 07:59:01 +02:00
cifs cifs: return correct error in ->calc_signature() 2022-10-26 12:35:26 +02:00
coda
…
configfs configfs: fix a race in configfs_{,un}register_subsystem() 2022-03-02 11:48:02 +01:00
cramfs
…
crypto fscrypt: allow 256-bit master keys with AES-256-XTS 2021-11-18 19:16:11 +01:00
debugfs debugfs: add debugfs_lookup_and_remove() 2022-09-15 11:30:02 +02:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:27:01 +01:00
dlm fs: dlm: fix race in lowcomms 2022-10-26 12:35:29 +02:00
ecryptfs fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
efivarfs
…
efs
…
erofs erofs: fix pcluster use-after-free on UP platforms 2022-09-15 11:30:06 +02:00
exfat exfat: use updated exfat_chain directly during renaming 2022-07-29 17:25:30 +02:00
exportfs exportfs: support idmapped mounts 2022-06-09 10:23:32 +02:00
ext2 ext2: Add more validity checks for inode counts 2022-08-17 14:23:00 +02:00
ext4 ext4: don't run ext4lazyinit for read-only filesystems 2022-10-26 12:35:01 +02:00
f2fs f2fs: fix to account FS_CP_DATA_IO correctly 2022-10-26 12:35:28 +02:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-09 10:22:42 +02:00
freevxfs
…
fscache
…
fuse fuse: Remove the control interface for virtio-fs 2022-08-17 14:24:11 +02:00
gfs2 gfs2: Fix gfs2_file_buffered_write endless loop workaround 2022-07-12 16:34:59 +02:00
hfs
…
hfsplus
…
hostfs
…
hpfs
…
hugetlbfs hugetlbfs: fix hugetlbfs_statfs() locking 2022-06-09 10:23:11 +02:00
iomap iomap: iomap_write_failed fix 2022-06-09 10:22:55 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 15:05:50 +01:00
jbd2 jbd2: add miss release buffer head in fc_do_one_pass() 2022-10-26 12:34:28 +02:00
jffs2 jffs2: fix memory leak in jffs2_do_fill_super 2022-06-14 18:36:10 +02:00
jfs fs: jfs: fix possible NULL pointer dereference in dbFree() 2022-06-09 10:22:41 +02:00
kernfs kernfs: Separate kernfs_pr_cont_buf and rename_lock. 2022-06-14 18:36:22 +02:00
ksmbd ksmbd: Fix user namespace mapping 2022-10-26 12:34:26 +02:00
lockd lockd: detect and reject lock arguments that overflow 2022-08-17 14:22:47 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-13 20:59:10 +02:00
netfs netfs: fix parameter of cleanup() 2021-12-29 12:28:59 +01:00
nfs NFSv4: Fixes for nfs4_inode_return_delegation() 2022-09-28 11:11:57 +02:00
nfs_common
…
nfsd NFSD: fix use-after-free on source server when doing inter-server copy 2022-10-26 12:35:32 +02:00
nilfs2 nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure 2022-10-15 07:59:01 +02:00
nls
…
notify fsnotify: fix wrong lockdep annotations 2022-06-09 10:22:50 +02:00
ntfs ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() 2022-10-05 10:39:37 +02:00
ntfs3 ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers 2022-10-26 12:34:36 +02:00
ocfs2 Revert "ocfs2: mount shared volume without ha stack" 2022-08-03 12:03:41 +02:00
omfs
…
openpromfs
…
orangefs orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() 2022-01-20 09:13:13 +01:00
overlayfs ovl: warn if trusted xattr creation fails 2022-08-25 11:40:43 +02:00
proc mm/smaps: don't access young/dirty bit if pte unpresent 2022-08-31 17:16:37 +02:00
pstore pstore: Don't use semaphores in always-atomic-context code 2022-04-08 14:23:01 +02:00
qnx4
…
qnx6
…
quota quota: Check next/prev free block number after reading from quota file 2022-10-26 12:34:21 +02:00
ramfs
…
reiserfs
…
romfs
…
smbfs_common cifs: Fix crash on unload of cifs_arc4.ko 2021-12-14 10:57:12 +01:00
squashfs
…
sysfs
…
sysv
…
tracefs tracefs: Only clobber mode/uid/gid on remount if asked 2022-09-20 12:39:43 +02:00
ubifs ubifs: rename_whiteout: correct old_dir size computing 2022-04-08 14:24:08 +02:00
udf udf: Avoid using stale lengthOfImpUse 2022-05-15 20:18:52 +02:00
ufs
…
unicode
…
vboxsf
…
verity
…
xfs fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE 2022-10-26 12:34:27 +02:00
zonefs block: add a bdev_max_zone_append_sectors helper 2022-08-31 17:16:34 +02:00
Kconfig
…
Kconfig.binfmt
…
Makefile
…
aio.c aio: Fix incorrect usage of eventfd_signal_allowed() 2021-12-14 10:57:22 +01:00
anon_inodes.c
…
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-17 14:22:50 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf.c coredump: Use the vma snapshot in fill_files_note 2022-04-08 14:24:18 +02:00
binfmt_elf_fdpic.c coredump: Snapshot the vmas in do_coredump 2022-04-08 14:24:17 +02:00
binfmt_flat.c binfmt_flat: do not stop relocating GOT entries prematurely on riscv 2022-06-09 10:22:26 +02:00
binfmt_misc.c
…
binfmt_script.c
…
buffer.c mm: fs: fix lru_cache_disabled race in bh_lru 2022-04-08 14:22:54 +02:00
char_dev.c
…
compat_binfmt_elf.c
…
coredump.c coredump: Use the vma snapshot in fill_files_note 2022-04-08 14:24:18 +02:00
d_path.c
…
dax.c fsdax: Fix infinite loop in dax_iomap_rw() 2022-09-28 11:11:56 +02:00
dcache.c
…
direct-io.c
…
drop_caches.c
…
eventfd.c
…
eventpoll.c epoll: autoremove wakers even more aggressively 2022-08-17 14:22:59 +02:00
exec.c posix-cpu-timers: Cleanup CPU timers before freeing them during exec 2022-08-17 14:24:19 +02:00
fcntl.c
…
fhandle.c
…
file.c fs: fix fd table size alignment properly 2022-04-08 14:23:54 +02:00
file_table.c locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
filesystems.c
…
fs-writeback.c fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE 2022-10-26 12:34:27 +02:00
fs_context.c vfs: fs_context: fix up param length parsing in legacy_parse_param 2022-01-20 09:13:14 +01:00
fs_parser.c
…
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fsopen.c
…
init.c
…
inode.c fs: fix UAF/GPF bug in nilfs_mdt_destroy 2022-10-12 09:53:26 +02:00
internal.h locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
io-wq.c io-wq: drop wqe lock before creating new worker 2021-12-22 09:32:51 +01:00
io-wq.h
…
io_uring.c io_uring/net: don't update msg_name if not provided 2022-10-26 12:34:18 +02:00
ioctl.c fs: fix an infinite loop in iomap_fiemap 2022-05-25 09:57:26 +02:00
kernel_read_file.c
…
libfs.c
…
locks.c
…
mbcache.c mbcache: add functions to delete entry if unused 2022-08-17 14:22:57 +02:00
mount.h
…
mpage.c
…
namei.c __follow_mount_rcu(): verify that mount_lock remains unchanged 2022-08-17 14:24:19 +02:00
namespace.c fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts 2022-08-31 17:16:37 +02:00
no-block.c
…
nsfs.c
…
open.c locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
pipe.c pipe: Fix missing lock in pipe_resize_ring() 2022-06-06 08:43:37 +02:00
pnode.c
…
pnode.h
…
posix_acl.c fs: fix acl translation 2022-07-02 16:41:17 +02:00
proc_namespace.c fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
read_write.c fs: sendfile handles O_NONBLOCK of out_fd 2022-08-03 12:03:41 +02:00
readdir.c
…
remap_range.c fs/remap: constrain dedupe of EOF blocks 2022-07-21 21:24:14 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:58:25 +01:00
seq_file.c rxrpc: Fix locking issue 2022-07-12 16:35:08 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:57:15 +01:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-26 12:34:17 +02:00
stack.c
…
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 14:38:57 +02:00
statfs.c
…
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 12:03:05 +01:00
sync.c vfs: make sync_filesystem return errors from ->sync_fs 2022-04-27 14:38:50 +02:00
timerfd.c
…
userfaultfd.c userfaultfd: open userfaultfds with O_RDONLY 2022-10-26 12:34:36 +02:00
utimes.c
…
xattr.c fs: split off setxattr_copy and do_setxattr function from setxattr 2022-10-05 10:39:44 +02:00