lkml.org 
[lkml]   [2021]   [Sep]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 050/260] SUNRPC: Fix potential memory corruption
    Date
    From: Trond Myklebust <trond.myklebust@hammerspace.com>

    [ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]

    We really should not call rpc_wake_up_queued_task_set_status() with
    xprt->snd_task as an argument unless we are certain that is actually an
    rpc_task.

    Fixes: 0445f92c5d53 ("SUNRPC: Fix disconnection races")
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/sunrpc/xprt.h | 1 +
    net/sunrpc/xprt.c | 6 ++++--
    2 files changed, 5 insertions(+), 2 deletions(-)

    diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
    index d7ef5b97174c..3c6c4b1dbf1a 100644
    --- a/include/linux/sunrpc/xprt.h
    +++ b/include/linux/sunrpc/xprt.h
    @@ -419,6 +419,7 @@ void xprt_unlock_connect(struct rpc_xprt *, void *);
    #define XPRT_CONGESTED (9)
    #define XPRT_CWND_WAIT (10)
    #define XPRT_WRITE_SPACE (11)
    +#define XPRT_SND_IS_COOKIE (12)

    static inline void xprt_set_connected(struct rpc_xprt *xprt)
    {
    diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
    index 639837b3a5d9..3653898f465f 100644
    --- a/net/sunrpc/xprt.c
    +++ b/net/sunrpc/xprt.c
    @@ -729,9 +729,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)
    /* Try to schedule an autoclose RPC call */
    if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
    queue_work(xprtiod_workqueue, &xprt->task_cleanup);
    - else if (xprt->snd_task)
    + else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
    rpc_wake_up_queued_task_set_status(&xprt->pending,
    - xprt->snd_task, -ENOTCONN);
    + xprt->snd_task, -ENOTCONN);
    spin_unlock(&xprt->transport_lock);
    }
    EXPORT_SYMBOL_GPL(xprt_force_disconnect);
    @@ -820,6 +820,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
    goto out;
    if (xprt->snd_task != task)
    goto out;
    + set_bit(XPRT_SND_IS_COOKIE, &xprt->state);
    xprt->snd_task = cookie;
    ret = true;
    out:
    @@ -835,6 +836,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
    if (!test_bit(XPRT_LOCKED, &xprt->state))
    goto out;
    xprt->snd_task =NULL;
    + clear_bit(XPRT_SND_IS_COOKIE, &xprt->state);
    xprt->ops->release_xprt(xprt, NULL);
    xprt_schedule_autodisconnect(xprt);
    out:
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-09-20 20:19    [W:2.191 / U:0.184 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site