Commit e7fcf179 authored by Chuck Lever's avatar Chuck Lever
Browse files

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd 



The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.

Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.

Reported-by: default avatarMisbah Anjum N <misanjum@linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/


Fixes: 96d851c4 ("nfsd: use proper net while reading "exports" file")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Reviewed-by: default avatarNeilBrown <neil@brown.name>
Tested-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 48db8923

fs/nfsd/nfsctl.c

+12 −2
Original line number Diff line number Diff line
@@ -149,9 +149,19 @@ static int exports_net_open(struct net *net, struct file *file) 


	seq = file->private_data;

	seq->private = nn->svc_export_cache;

	get_net(net);

	return 0;

}



static int exports_release(struct inode *inode, struct file *file)

{

	struct seq_file *seq = file->private_data;

	struct cache_detail *cd = seq->private;



	put_net(cd->net);

	return seq_release(inode, file);

}



static int exports_nfsd_open(struct inode *inode, struct file *file)

{

	return exports_net_open(inode->i_sb->s_fs_info, file);
@@ -161,7 +171,7 @@ static const struct file_operations exports_nfsd_operations = { 
	.open		= exports_nfsd_open,

	.read		= seq_read,

	.llseek		= seq_lseek,

	.release	= seq_release,

	.release	= exports_release,

};



static int export_features_show(struct seq_file *m, void *v)
@@ -1376,7 +1386,7 @@ static const struct proc_ops exports_proc_ops = { 
	.proc_open	= exports_proc_open,

	.proc_read	= seq_read,

	.proc_lseek	= seq_lseek,

	.proc_release	= seq_release,

	.proc_release	= exports_release,

};



static int create_proc_exports_entry(void)