Commit 64bed6cb authored by Amir Goldstein's avatar Amir Goldstein Committed by J. Bruce Fields

nfsd: fix leaked file lock with nfs exported overlayfs

nfsd and lockd call vfs_lock_file() to lock/unlock the inode
returned by locks_inode(file).

Many places in nfsd/lockd code use the inode returned by
file_inode(file) for lock manipulation. With Overlayfs, file_inode()
(the underlying inode) is not the same object as locks_inode() (the
overlay inode). This can result in "Leaked POSIX lock" messages
and eventually to a kernel crash as reported by Eddie Horng:
https://marc.info/?l=linux-unionfs&m=153086643202072&w=2

Fix all the call sites in nfsd/lockd that should use locks_inode().
This is a correctness bug that manifested when overlayfs gained
NFS export support in v4.16.
Reported-by: default avatarEddie Horng <eddiehorng.tw@gmail.com>
Tested-by: default avatarEddie Horng <eddiehorng.tw@gmail.com>
Cc: Jeff Layton <jlayton@kernel.org>
Fixes: 8383f174 ("ovl: wire up NFS export operations")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 8163496e
...@@ -187,7 +187,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock) ...@@ -187,7 +187,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock)
continue; continue;
if (!rpc_cmp_addr(nlm_addr(block->b_host), addr)) if (!rpc_cmp_addr(nlm_addr(block->b_host), addr))
continue; continue;
if (nfs_compare_fh(NFS_FH(file_inode(fl_blocked->fl_file)) ,fh) != 0) if (nfs_compare_fh(NFS_FH(locks_inode(fl_blocked->fl_file)), fh) != 0)
continue; continue;
/* Alright, we found a lock. Set the return status /* Alright, we found a lock. Set the return status
* and wake up the caller * and wake up the caller
......
...@@ -128,7 +128,7 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl) ...@@ -128,7 +128,7 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl)
char *nodename = req->a_host->h_rpcclnt->cl_nodename; char *nodename = req->a_host->h_rpcclnt->cl_nodename;
nlmclnt_next_cookie(&argp->cookie); nlmclnt_next_cookie(&argp->cookie);
memcpy(&lock->fh, NFS_FH(file_inode(fl->fl_file)), sizeof(struct nfs_fh)); memcpy(&lock->fh, NFS_FH(locks_inode(fl->fl_file)), sizeof(struct nfs_fh));
lock->caller = nodename; lock->caller = nodename;
lock->oh.data = req->a_owner; lock->oh.data = req->a_owner;
lock->oh.len = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s", lock->oh.len = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s",
......
...@@ -405,8 +405,8 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file, ...@@ -405,8 +405,8 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
__be32 ret; __be32 ret;
dprintk("lockd: nlmsvc_lock(%s/%ld, ty=%d, pi=%d, %Ld-%Ld, bl=%d)\n", dprintk("lockd: nlmsvc_lock(%s/%ld, ty=%d, pi=%d, %Ld-%Ld, bl=%d)\n",
file_inode(file->f_file)->i_sb->s_id, locks_inode(file->f_file)->i_sb->s_id,
file_inode(file->f_file)->i_ino, locks_inode(file->f_file)->i_ino,
lock->fl.fl_type, lock->fl.fl_pid, lock->fl.fl_type, lock->fl.fl_pid,
(long long)lock->fl.fl_start, (long long)lock->fl.fl_start,
(long long)lock->fl.fl_end, (long long)lock->fl.fl_end,
...@@ -511,8 +511,8 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, ...@@ -511,8 +511,8 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file,
__be32 ret; __be32 ret;
dprintk("lockd: nlmsvc_testlock(%s/%ld, ty=%d, %Ld-%Ld)\n", dprintk("lockd: nlmsvc_testlock(%s/%ld, ty=%d, %Ld-%Ld)\n",
file_inode(file->f_file)->i_sb->s_id, locks_inode(file->f_file)->i_sb->s_id,
file_inode(file->f_file)->i_ino, locks_inode(file->f_file)->i_ino,
lock->fl.fl_type, lock->fl.fl_type,
(long long)lock->fl.fl_start, (long long)lock->fl.fl_start,
(long long)lock->fl.fl_end); (long long)lock->fl.fl_end);
...@@ -566,8 +566,8 @@ nlmsvc_unlock(struct net *net, struct nlm_file *file, struct nlm_lock *lock) ...@@ -566,8 +566,8 @@ nlmsvc_unlock(struct net *net, struct nlm_file *file, struct nlm_lock *lock)
int error; int error;
dprintk("lockd: nlmsvc_unlock(%s/%ld, pi=%d, %Ld-%Ld)\n", dprintk("lockd: nlmsvc_unlock(%s/%ld, pi=%d, %Ld-%Ld)\n",
file_inode(file->f_file)->i_sb->s_id, locks_inode(file->f_file)->i_sb->s_id,
file_inode(file->f_file)->i_ino, locks_inode(file->f_file)->i_ino,
lock->fl.fl_pid, lock->fl.fl_pid,
(long long)lock->fl.fl_start, (long long)lock->fl.fl_start,
(long long)lock->fl.fl_end); (long long)lock->fl.fl_end);
...@@ -595,8 +595,8 @@ nlmsvc_cancel_blocked(struct net *net, struct nlm_file *file, struct nlm_lock *l ...@@ -595,8 +595,8 @@ nlmsvc_cancel_blocked(struct net *net, struct nlm_file *file, struct nlm_lock *l
int status = 0; int status = 0;
dprintk("lockd: nlmsvc_cancel(%s/%ld, pi=%d, %Ld-%Ld)\n", dprintk("lockd: nlmsvc_cancel(%s/%ld, pi=%d, %Ld-%Ld)\n",
file_inode(file->f_file)->i_sb->s_id, locks_inode(file->f_file)->i_sb->s_id,
file_inode(file->f_file)->i_ino, locks_inode(file->f_file)->i_ino,
lock->fl.fl_pid, lock->fl.fl_pid,
(long long)lock->fl.fl_start, (long long)lock->fl.fl_start,
(long long)lock->fl.fl_end); (long long)lock->fl.fl_end);
......
...@@ -44,7 +44,7 @@ static inline void nlm_debug_print_fh(char *msg, struct nfs_fh *f) ...@@ -44,7 +44,7 @@ static inline void nlm_debug_print_fh(char *msg, struct nfs_fh *f)
static inline void nlm_debug_print_file(char *msg, struct nlm_file *file) static inline void nlm_debug_print_file(char *msg, struct nlm_file *file)
{ {
struct inode *inode = file_inode(file->f_file); struct inode *inode = locks_inode(file->f_file);
dprintk("lockd: %s %s/%ld\n", dprintk("lockd: %s %s/%ld\n",
msg, inode->i_sb->s_id, inode->i_ino); msg, inode->i_sb->s_id, inode->i_ino);
...@@ -414,7 +414,7 @@ nlmsvc_match_sb(void *datap, struct nlm_file *file) ...@@ -414,7 +414,7 @@ nlmsvc_match_sb(void *datap, struct nlm_file *file)
{ {
struct super_block *sb = datap; struct super_block *sb = datap;
return sb == file_inode(file->f_file)->i_sb; return sb == locks_inode(file->f_file)->i_sb;
} }
/** /**
......
...@@ -6322,7 +6322,7 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) ...@@ -6322,7 +6322,7 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
return status; return status;
} }
inode = file_inode(filp); inode = locks_inode(filp);
flctx = inode->i_flctx; flctx = inode->i_flctx;
if (flctx && !list_empty_careful(&flctx->flc_posix)) { if (flctx && !list_empty_careful(&flctx->flc_posix)) {
......
...@@ -299,7 +299,7 @@ int nlmsvc_unlock_all_by_ip(struct sockaddr *server_addr); ...@@ -299,7 +299,7 @@ int nlmsvc_unlock_all_by_ip(struct sockaddr *server_addr);
static inline struct inode *nlmsvc_file_inode(struct nlm_file *file) static inline struct inode *nlmsvc_file_inode(struct nlm_file *file)
{ {
return file_inode(file->f_file); return locks_inode(file->f_file);
} }
static inline int __nlm_privileged_request4(const struct sockaddr *sap) static inline int __nlm_privileged_request4(const struct sockaddr *sap)
...@@ -359,7 +359,7 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp) ...@@ -359,7 +359,7 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp)
static inline int nlm_compare_locks(const struct file_lock *fl1, static inline int nlm_compare_locks(const struct file_lock *fl1,
const struct file_lock *fl2) const struct file_lock *fl2)
{ {
return file_inode(fl1->fl_file) == file_inode(fl2->fl_file) return locks_inode(fl1->fl_file) == locks_inode(fl2->fl_file)
&& fl1->fl_pid == fl2->fl_pid && fl1->fl_pid == fl2->fl_pid
&& fl1->fl_owner == fl2->fl_owner && fl1->fl_owner == fl2->fl_owner
&& fl1->fl_start == fl2->fl_start && fl1->fl_start == fl2->fl_start
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment