diff mbox series

[4.9,63/80] nfsd: memory corruption in nfsd4_lock()

Message ID	20200501131532.279438484@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=1/SS=6P=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Vasily Averin <vvs@virtuozzo.com>, Jeff Layton <jlayton@kernel.org>, Chuck Lever <chuck.lever@oracle.com> Subject: [PATCH 4.9 63/80] nfsd: memory corruption in nfsd4_lock() Date: Fri, 1 May 2020 15:21:57 +0200 Message-Id: <20200501131532.279438484@linuxfoundation.org> In-Reply-To: <20200501131513.810761598@linuxfoundation.org> References: <20200501131513.810761598@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [4.9,02/80] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() [4.9,05/80] crypto: mxs-dcp - make symbols sha1_null_hash and sha256_null_hash static [4.9,06/80] vti4: removed duplicate log message. [4.9,10/80] ceph: dont skip updating wanted caps when cap is stale [4.9,11/80] pwm: rcar: Fix late Runtime PM enablement [4.9,13/80] ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() [4.9,14/80] kernel/gcov/fs.c: gcov_seq_next() should increase position index [4.9,19/80] PCI/ASPM: Allow re-enabling Clock PM [4.9,20/80] ipv6: fix restrict IPV6_ADDRFORM operation [4.9,21/80] macsec: avoid to set wrong mtu [4.9,22/80] macvlan: fix null dereference in macvlan_device_event() [4.9,23/80] net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node [4.9,25/80] tcp: cache line align MAX_TCP_HEADER [4.9,27/80] net: dsa: b53: Fix ARL register definitions [4.9,28/80] xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish [4.9,31/80] iio: xilinx-xadc: Fix clearing interrupt when enabling trigger [4.9,32/80] iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode [4.9,38/80] overflow.h: Add arithmetic shift helper [4.9,41/80] ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif [4.9,43/80] tpm/tpm_tis: Free IRQ if probing fails [4.9,44/80] KVM: Check validity of resolved slot when searching memslots [4.9,45/80] KVM: VMX: Enable machine check support for 32bit targets [4.9,46/80] tty: hvc: fix buffer overflow during hvc_alloc(). [4.9,48/80] usb-storage: Add unusual_devs entry for JMicron JMS566 [4.9,54/80] staging: vt6656: Fix drivers TBTT timing counter. [4.9,55/80] staging: vt6656: Power save stop wake_up_count wrap around. [4.9,57/80] UAS: fix deadlock in error handling and PM flushing work [4.9,59/80] remoteproc: Fix wrong rvring index computation [4.9,60/80] fuse: fix possibly missed wake-up after abort [4.9,63/80] nfsd: memory corruption in nfsd4_lock() [4.9,64/80] net/cxgb4: Check the return from t4_query_params properly [4.9,65/80] perf/core: fix parent pid/tid in task exit events [4.9,66/80] bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B [4.9,68/80] scsi: target: fix PR IN / READ FULL STATUS for FC [4.9,69/80] objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings [4.9,71/80] xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status [4.9,74/80] hwmon: (jc42) Fix name to have no illegal characters [4.9,77/80] ext4: dont perform block validity checks on the journal inode [4.9,79/80] ext4: unsigned int compared against zero

Commit Message

Greg KH May 1, 2020, 1:21 p.m. UTC

From: Vasily Averin <vvs@virtuozzo.com>

commit e1e8399eee72e9d5246d4d1bcacd793debe34dd3 upstream.

New struct nfsd4_blocked_lock allocated in find_or_allocate_block()
does not initialized nbl_list and nbl_lru.
If conflock allocation fails rollback can call list_del_init()
access uninitialized fields and corrupt memory.

v2: just initialize nbl_list and nbl_lru right after nbl allocation.

Fixes: 76d348fadff5 ("nfsd: have nfsd4_lock use blocking locks for v4.1+ lock")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfs4state.c |    2 ++
 1 file changed, 2 insertions(+)

diff mbox series

Patch

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -246,6 +246,8 @@  find_or_allocate_block(struct nfs4_locko
 	if (!nbl) {
 		nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
 		if (nbl) {
+			INIT_LIST_HEAD(&nbl->nbl_list);
+			INIT_LIST_HEAD(&nbl->nbl_lru);
 			fh_copy_shallow(&nbl->nbl_fh, fh);
 			locks_init_lock(&nbl->nbl_lock);
 			nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,