mirror of
https://github.com/linux-msm/laptops-kernel.git
synced 2026-08-13 14:19:53 -07:00
Jeff LaytonandChuck Lever
d1423ab077
nlmsvc_ops is published by nfsd_lockd_init() and cleared by
nfsd_lockd_shutdown() with plain stores, while lockd dereferences
it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer
targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's
.text, so a stale load after rmmod nfsd results in either a NULL
deref or a module-text use-after-free.
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear
via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module
*owner field to nlmsvc_binding and pin the module across indirect
calls with try_module_get/module_put. When the binding is torn down,
fall back to fput() to avoid leaking struct file references.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-16-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
92 lines
2.6 KiB
C
92 lines
2.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* linux/include/linux/lockd/bind.h
|
|
*
|
|
* This is the part of lockd visible to nfsd and the nfs client.
|
|
*
|
|
* Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
|
|
*/
|
|
|
|
#ifndef LINUX_LOCKD_BIND_H
|
|
#define LINUX_LOCKD_BIND_H
|
|
|
|
struct file_lock;
|
|
struct nfs_fh;
|
|
struct svc_rqst;
|
|
struct rpc_task;
|
|
struct rpc_clnt;
|
|
struct super_block;
|
|
struct module;
|
|
|
|
/**
|
|
* struct nlmsvc_binding - lockd -> nfsd callback table
|
|
* @owner: module that provides this binding.
|
|
* @fopen: open a file by NFS file handle on behalf of an NLM request.
|
|
* @fclose: close a file that was previously opened via @fopen.
|
|
* Implementations MUST be semantically equivalent to fput().
|
|
*/
|
|
struct nlmsvc_binding {
|
|
struct module *owner;
|
|
int (*fopen)(struct svc_rqst *rqstp, struct nfs_fh *f,
|
|
struct file **filp, int flags);
|
|
void (*fclose)(struct file *filp);
|
|
};
|
|
|
|
extern const struct nlmsvc_binding __rcu *nlmsvc_ops;
|
|
|
|
/*
|
|
* Similar to nfs_client_initdata, but without the NFS-specific
|
|
* rpc_ops field.
|
|
*/
|
|
struct nlmclnt_initdata {
|
|
const char *hostname;
|
|
const struct sockaddr *address;
|
|
size_t addrlen;
|
|
unsigned short protocol;
|
|
u32 nfs_version;
|
|
int noresvport;
|
|
struct net *net;
|
|
const struct nlmclnt_operations *nlmclnt_ops;
|
|
const struct cred *cred;
|
|
};
|
|
|
|
/*
|
|
* Functions exported by the lockd module
|
|
*/
|
|
|
|
extern struct nlm_host *nlmclnt_init(const struct nlmclnt_initdata *nlm_init);
|
|
extern void nlmclnt_done(struct nlm_host *host);
|
|
extern struct rpc_clnt *nlmclnt_rpc_clnt(struct nlm_host *host);
|
|
extern void nlmclnt_shutdown_rpc_clnt(struct nlm_host *host);
|
|
|
|
/*
|
|
* NLM client operations provide a means to modify RPC processing of NLM
|
|
* requests. Callbacks receive a pointer to data passed into the call to
|
|
* nlmclnt_proc().
|
|
*/
|
|
struct nlmclnt_operations {
|
|
/* Called on successful allocation of nlm_rqst, use for allocation or
|
|
* reference counting. */
|
|
void (*nlmclnt_alloc_call)(void *);
|
|
|
|
/* Called in rpc_task_prepare for unlock. A return value of true
|
|
* indicates the callback has put the task to sleep on a waitqueue
|
|
* and NLM should not call rpc_call_start(). */
|
|
bool (*nlmclnt_unlock_prepare)(struct rpc_task*, void *);
|
|
|
|
/* Called when the nlm_rqst is freed, callbacks should clean up here */
|
|
void (*nlmclnt_release_call)(void *);
|
|
};
|
|
|
|
extern int nlmclnt_proc(struct nlm_host *host, int cmd, struct file_lock *fl, void *data);
|
|
extern int lockd_up(struct net *net, const struct cred *cred);
|
|
extern void lockd_down(struct net *net);
|
|
|
|
/*
|
|
* Cluster failover support
|
|
*/
|
|
int nlmsvc_unlock_all_by_sb(struct super_block *sb);
|
|
int nlmsvc_unlock_all_by_ip(struct sockaddr *server_addr);
|
|
|
|
#endif /* LINUX_LOCKD_BIND_H */
|