redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

NFS: Fix use-after-free issues in nfs_pageio_add_request() 

commit dc9dc2febb upstream.

We need to ensure that we create the mirror requests before calling
nfs_pageio_add_request_mirror() on the request we are adding.
Otherwise, we can end up with a use-after-free if the call to
nfs_pageio_add_request_mirror() triggers I/O.

Fixes: c917cfaf9b ("NFS: Fix up NFS I/O subrequest creation")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
Trond Myklebust 2020-03-29 19:55:05 -04:00 committed by Greg Kroah-Hartman
parent 98a817eda5
commit 6b64cbd058
1 changed files with 21 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
fs/nfs/pagelist.c
View File

@ -1177,38 +1177,38 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
if (desc->pg_error < 0)
goto out_failed;
for (midx = 0; midx < desc->pg_mirror_count; midx++) {
if (midx) {
nfs_page_group_lock(req);
/* Create the mirror instances first, and fire them off */
for (midx = 1; midx < desc->pg_mirror_count; midx++) {
nfs_page_group_lock(req);
/* find the last request */
for (lastreq = req->wb_head;
lastreq->wb_this_page != req->wb_head;
lastreq = lastreq->wb_this_page)
;
/* find the last request */
for (lastreq = req->wb_head;
lastreq->wb_this_page != req->wb_head;
lastreq = lastreq->wb_this_page)
;
dupreq = nfs_create_subreq(req, lastreq,
pgbase, offset, bytes);
dupreq = nfs_create_subreq(req, lastreq,
pgbase, offset, bytes);
nfs_page_group_unlock(req);
if (IS_ERR(dupreq)) {
desc->pg_error = PTR_ERR(dupreq);
goto out_failed;
}
} else
dupreq = req;
nfs_page_group_unlock(req);
if (IS_ERR(dupreq)) {
desc->pg_error = PTR_ERR(dupreq);
goto out_failed;
}
if (nfs_pgio_has_mirroring(desc))
desc->pg_mirror_idx = midx;
desc->pg_mirror_idx = midx;
if (!nfs_pageio_add_request_mirror(desc, dupreq))
goto out_cleanup_subreq;
}
desc->pg_mirror_idx = 0;
if (!nfs_pageio_add_request_mirror(desc, req))
goto out_failed;
return 1;
out_cleanup_subreq:
if (req != dupreq)
nfs_pageio_cleanup_request(desc, dupreq);
nfs_pageio_cleanup_request(desc, dupreq);
out_failed:
nfs_pageio_error_cleanup(desc);
return 0;