lkml.org 
[lkml]   [2022]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH 23/23] SUNRPC: lock against ->sock changing during sysfs read
    From
    Date
    ->sock can be set to NULL asynchronously unless ->recv_mutex is held.
    So it is important to hold that mutex. Otherwise a sysfs read can
    trigger an oops.
    Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before
    handling sysfs reads") appears to attempt to fix this problem, but it
    only narrows the race window.

    Fixes: 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads")
    Fixes: a8482488a7d6 ("SUNRPC query transport's source port")
    Signed-off-by: NeilBrown <neilb@suse.de>
    ---
    net/sunrpc/sysfs.c | 5 ++++-
    net/sunrpc/xprtsock.c | 7 ++++++-
    2 files changed, 10 insertions(+), 2 deletions(-)

    diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c
    index 2766dd21935b..baaf65ea9e38 100644
    --- a/net/sunrpc/sysfs.c
    +++ b/net/sunrpc/sysfs.c
    @@ -115,11 +115,14 @@ static ssize_t rpc_sysfs_xprt_srcaddr_show(struct kobject *kobj,
    }

    sock = container_of(xprt, struct sock_xprt, xprt);
    - if (kernel_getsockname(sock->sock, (struct sockaddr *)&saddr) < 0)
    + mutex_lock(&sock->recv_mutex);
    + if (sock->sock == NULL ||
    + kernel_getsockname(sock->sock, (struct sockaddr *)&saddr) < 0)
    goto out;

    ret = sprintf(buf, "%pISc\n", &saddr);
    out:
    + mutex_unlock(&sock->recv_mutex);
    xprt_put(xprt);
    return ret + 1;
    }
    diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    index 9d34c71004fa..3f2b766e9f82 100644
    --- a/net/sunrpc/xprtsock.c
    +++ b/net/sunrpc/xprtsock.c
    @@ -1641,7 +1641,12 @@ static int xs_get_srcport(struct sock_xprt *transport)
    unsigned short get_srcport(struct rpc_xprt *xprt)
    {
    struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);
    - return xs_sock_getport(sock->sock);
    + unsigned short ret = 0;
    + mutex_lock(&sock->recv_mutex);
    + if (sock->sock)
    + ret = xs_sock_getport(sock->sock);
    + mutex_unlock(&sock->recv_mutex);
    + return ret;
    }
    EXPORT_SYMBOL(get_srcport);


    \
     
     \ /
      Last update: 2022-01-24 04:56    [W:4.319 / U:0.208 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site