Messages in this thread |  | | Subject | Re: [PATCH 0/6] SUNRPC: Address remaining cache_check_rcu() UAF in cache content files | | From | Jeff Layton <> | | Date | Tue, 05 May 2026 07:32:49 +0200 |
| |
On Fri, 2026-05-01 at 10:51 -0400, Chuck Lever wrote: > Misbah Anjum reported a use-after-free in cache_check_rcu() > reached through e_show() while sosreport was reading > /proc/fs/nfsd/exports on ppc64le. Two fixes for that report > landed in v7.0: > > 48db892356d6 ("NFSD: Defer sub-object cleanup in export put callbacks") > e7fcf179b82d ("NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd") > > The original e_show() repro is now fixed. However, the same > sosreport workload still reproduces a closely related fault on > post-v7.0 mainline (Misbah, ppc64le) and on master.20260424 > (internal report, aarch64). In both cases the fault is in > cache_check_rcu() reached through c_show() rather than e_show(), > and the cache_head pointer is plain garbage: > > pc : cache_check_rcu+0x40 [sunrpc] > lr : c_show+0x60 [sunrpc] > ...faulting on h->flags off h = 0x0000000200000000 > > c_show() is the generic show callback used by > /proc/net/rpc/<cd>/content for every per-net cache_detail > (auth.unix.ip, auth.unix.gid, nfsd.fh, nfsd.export). Two > bugs combine in that path: > > 1. cache_unregister_net() / cache_destroy_net() free cd and > cd->hash_table synchronously when the namespace exits. The > /proc/net/rpc/.../content open path takes only a module > reference, so a fd kept open across a netns exit walks a > freed hash_table and returns garbage cache_head pointers. > This is the same hazard that e7fcf179b82d closed for the > /proc/fs/nfs/exports file alone. > > 2. ip_map_put() drops auth_domain_put() before kfree_rcu(), so > sub-objects can be freed before the RCU grace period -- the > same hazard that 48db892356d6 fixed for svc_export_put() and > expkey_put(). unix_gid_put() does not have this bug > structurally (its put_group_info() runs inside the call_rcu() > callback) but it uses a separate idiom from the other three > caches. > > This series replaces the v1 narrow fixes with shared > infrastructure that covers all four cache_detail .put paths > and all three per-cache file types: > > Patch 1 hoists nfsd_export_wq up to the sunrpc layer as > sunrpc_cache_wq, exposed through sunrpc_cache_queue_release() > and sunrpc_cache_drain() so all four put callbacks share one > workqueue and one drain primitive. > > Patch 2 converts ip_map_put() to the queue_rcu_work() pattern, > moving auth_domain_put() into a deferred ip_map_release() that > runs after the RCU grace period. > > Patch 3 unifies unix_gid_put() onto the same pattern for > consistency (not a bug fix on its own). > > Patch 4 takes a get_net(cd->net) in content_open(), cache_open(), > and open_flush() and drops it in the matching release helpers, > so cache_destroy_net() cannot run while a sunrpc cache fd is > open. > > Series has been compile-tested only. > > --- > Chuck Lever (6): > SUNRPC: Move cache_initialize() declaration to sunrpc-private header > SUNRPC: Provide a shared workqueue for cache release callbacks > SUNRPC: Defer ip_map sub-object cleanup past RCU grace period > SUNRPC: Use shared release pattern for the unix_gid cache > SUNRPC: Hold cd->net for the lifetime of cache files > NFSD: Convert nfsd_export_shutdown() to sunrpc_cache_destroy_net() > > fs/nfsd/export.c | 45 ++-------------------- > fs/nfsd/export.h | 2 - > fs/nfsd/nfsctl.c | 8 +--- > include/linux/sunrpc/cache.h | 3 +- > net/sunrpc/cache.c | 90 ++++++++++++++++++++++++++++++++++++++++++-- > net/sunrpc/sunrpc.h | 2 + > net/sunrpc/sunrpc_syms.c | 23 ++++++----- > net/sunrpc/svcauth_unix.c | 46 ++++++++++++---------- > 8 files changed, 135 insertions(+), 84 deletions(-) > --- > base-commit: f3a313ecd1fdab1f5da119db355363b13af6fcac > change-id: 20260430-cache-uaf-fix-a13000f67c37 > > Best regards, > -- > Chuck Lever
The series looks sane.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
|  |