linux_dsm_epyc7002/fs/nfs
Anna Schumaker c3b6cf64df NFS: Fix use-after-free in nfs4_init_client()
commit 476bdb04c501fc64bf3b8464ffddefc8dbe01577 upstream.

KASAN reports a use-after-free when attempting to mount two different
exports through two different NICs that belong to the same server.

Olga was able to hit this with kernels starting somewhere between 5.7
and 5.10, but I traced the patch that introduced the clear_bit() call to
4.13. So something must have changed in the refcounting of the clp
pointer to make this call to nfs_put_client() the very last one.

Fixes: 8dcbec6d20 ("NFSv41: Handle EXCHID4_FLAG_CONFIRMED_R during NFSv4.1 migration")
Cc: stable@vger.kernel.org # 4.13+
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-16 12:01:46 +02:00
..
blocklayout treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
filelayout NFS: fix an incorrect limit in filelayout_decode_layout() 2021-06-03 09:00:35 +02:00
flexfilelayout pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() 2021-05-19 10:13:03 +02:00
cache_lib.c NFS client updates for Linux 4.15 2017-11-17 14:18:00 -08:00
cache_lib.h NFS client updates for Linux 4.15 2017-11-17 14:18:00 -08:00
callback_proc.c NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting 2021-05-19 10:13:03 +02:00
callback_xdr.c NFS4: Report callback authentication errors 2020-01-15 10:54:31 -05:00
callback.c SUNRPC: Cache the process user cred in the RPC server listener 2019-04-24 09:46:35 -04:00
callback.h NFSv4: Add support for CB_RECALL_ANY for flexfiles layouts 2020-03-16 08:34:30 -04:00
client.c NFS: Fix a potential NULL dereference in nfs_get_client() 2021-06-16 12:01:46 +02:00
delegation.c NFS: nfs_delegation_find_inode_server must first reference the superblock 2021-01-19 18:27:31 +01:00
delegation.h NFSv4: Ensure the delegation is pinned in nfs_do_return_delegation() 2020-02-13 16:18:50 -05:00
dir.c NFS: Don't gratuitously clear the inode cache when lookup failed 2021-03-17 17:06:33 +01:00
direct.c NFS client updates for Linux 5.9 2020-08-15 08:26:55 -07:00
dns_resolve.c NFS: remove duplicate headers 2020-05-27 10:10:12 -04:00
dns_resolve.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
export.c NFS: Add a tracepoint in nfs_fh_to_dentry() 2019-11-03 21:28:46 -05:00
file.c NFS client updates for Linux 5.9 2020-08-15 08:26:55 -07:00
fs_context.c NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds 2021-05-11 14:47:34 +02:00
fscache-index.c nfs: fscache: use timespec64 in inode auxdata 2020-01-15 10:54:30 -05:00
fscache.c NFSv4: Fix fscache cookie aux_data to ensure change_attr is included 2020-05-08 22:20:24 +01:00
fscache.h nfs: fscache: use timespec64 in inode auxdata 2020-01-15 10:54:30 -05:00
getroot.c NFS: Ensure security label is set for root inode 2020-03-30 19:56:50 -04:00
inode.c NFS: NFS_INO_REVAL_PAGECACHE should mark the change attribute invalid 2021-05-22 11:40:52 +02:00
internal.h NFS: nfs_igrab_and_active must first reference the superblock 2021-01-19 18:27:31 +01:00
io.c NFS: Fix up documentation warnings 2019-02-20 15:14:21 -05:00
iostat.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default 2021-03-30 14:31:49 +02:00
Makefile NFSv4.2: add client side xattr caching. 2020-07-13 17:52:46 -04:00
mount_clnt.c NFSv3: fix rpc receive buffer size for MOUNT call 2020-05-14 18:42:44 -04:00
namespace.c NFS: fix nfs_path in case of a rename retry 2020-10-06 10:21:18 -04:00
netns.h NFS: Add sysfs support for per-container identifier 2019-07-06 14:54:49 -04:00
nfs2super.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nfs2xdr.c nfs: remove timespec from xdr_encode_nfstime 2020-01-15 10:54:30 -05:00
nfs3_fs.h NFS: Additional refactoring for fs_context conversion 2020-01-15 10:15:17 -05:00
nfs3acl.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nfs3client.c NFS: Additional refactoring for fs_context conversion 2020-01-15 10:15:17 -05:00
nfs3proc.c NFS: move dprintk after nfs_alloc_fattr in nfs3_proc_lookup 2020-05-27 10:08:26 -04:00
nfs3super.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nfs3xdr.c NFS: Correct size calculation for create reply length 2021-03-30 14:31:49 +02:00
nfs4_fs.h NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() 2021-06-16 12:01:46 +02:00
nfs4client.c NFS: Fix use-after-free in nfs4_init_client() 2021-06-16 12:01:46 +02:00
nfs4file.c NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config 2021-06-03 09:00:36 +02:00
nfs4getroot.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nfs4idmap.c NFS: Only reference user namespace from nfs4idmap struct instead of cred 2020-10-13 15:56:54 -04:00
nfs4idmap.h NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4namespace.c nfs: Fix memory leak of export_path 2020-06-26 08:43:14 -04:00
nfs4proc.c NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() 2021-06-16 12:01:46 +02:00
nfs4renewd.c NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals 2020-02-04 12:27:55 -05:00
nfs4session.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
nfs4session.h NFSv4.1: Bump the default callback session slot count to 16 2019-03-02 16:25:26 -05:00
nfs4state.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nfs4super.c NFS: Adjust fs_context error logging 2021-01-19 18:27:30 +01:00
nfs4sysctl.c nfs: Do not convert nfs_idmap_cache_timeout to jiffies 2018-01-18 15:10:47 -05:00
nfs4trace.c pNFS/flexfiles: Add tracing for layout errors 2020-01-15 10:54:33 -05:00
nfs4trace.h NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE 2020-10-02 08:43:09 -04:00
nfs4xdr.c NFSv4: Fix the alignment of page data in the getdeviceinfo reply 2020-12-30 11:53:30 +01:00
nfs42.h NFSv4.2: add the extended attribute proc functions. 2020-07-13 17:52:45 -04:00
nfs42proc.c NFSv4.2 fix handling of sr_eof in SEEK's reply 2021-05-19 10:13:03 +02:00
nfs42xattr.c NFSv4.2: fix failure to unregister shrinker 2020-11-12 10:40:02 -05:00
nfs42xdr.c NFSv4.2: Don't error when exiting early on a READ_PLUS buffer overflow 2021-01-06 14:56:55 +01:00
nfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nfsroot.c nfsroot: Default mount option should ask for built-in NFS version 2020-11-02 10:29:03 -05:00
nfstrace.c NFS: Add trace events to report non-zero NFS status codes 2019-02-13 12:03:21 -05:00
nfstrace.h nfs: define and use the NFS_INO_INVALID_XATTR flag 2020-07-13 17:52:45 -04:00
pagelist.c NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() 2021-06-03 09:00:36 +02:00
pnfs_dev.c NFS/flexfiles: Speed up read failover when DSes are down 2019-03-01 22:37:38 -05:00
pnfs_nfs.c NFS/pNFS: Don't leak DS commits in pnfs_generic_retry_commit() 2021-01-19 18:27:31 +01:00
pnfs.c NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() 2021-06-03 09:00:27 +02:00
pnfs.h pNFS: We want return-on-close to complete when evicting the inode 2021-01-19 18:27:30 +01:00
proc.c NFS: Add softreval behaviour to nfs_lookup_revalidate() 2020-01-24 16:51:13 -05:00
read.c NFS: Trace short NFS READs 2020-06-11 13:33:48 -04:00
super.c The one new feature this time, from Anna Schumaker, is READ_PLUS, which 2020-10-22 09:44:27 -07:00
symlink.c nfs: pass the correct prototype to read_cache_page 2019-05-09 16:26:57 -04:00
sysctl.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysfs.c NFSv4: Fix up RCU annotations for struct nfs_netns_client 2020-10-15 13:31:08 -04:00
sysfs.h NFSv4: Fix up RCU annotations for struct nfs_netns_client 2020-10-15 13:31:08 -04:00
unlink.c NFS: Avoid referencing the cred twice in async rename/unlink 2020-03-16 08:34:29 -04:00
write.c mm/writeback: discard NR_UNSTABLE_NFS, use NR_WRITEBACK instead 2020-06-02 10:59:08 -07:00