Commit 31e9a7f3 authored May 09, 2020 by NeilBrown Committed by Trond Myklebust May 10, 2020

SUNRPC: fix use-after-free in rpc_free_client_work()



Parts of rpc_free_client() were recently moved to
a separate rpc_free_clent_work().  This introduced
a use-after-free as rpc_clnt_remove_pipedir() calls
rpc_net_ns(), and that uses clnt->cl_xprt which has already
been freed.
So move the call to xprt_put() after the call to
rpc_clnt_remove_pipedir().

Reported-by:  <syzbot+22b5ef302c7c40d94ea8@syzkaller.appspotmail.com>
Fixes: 7c4310ff ("SUNRPC: defer slow parts of rpc_free_client() to a workqueue.")
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

parent 2ef96a5b

net/sunrpc/clnt.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -890,6 +890,7 @@ static void rpc_free_client_work(struct work_struct *work)
		*/
		rpc_clnt_debugfs_unregister(clnt);
		rpc_clnt_remove_pipedir(clnt);
		xprt_put(rcu_dereference_raw(clnt->cl_xprt));

		kfree(clnt);
		rpciod_down();
		@@ -907,7 +908,6 @@ rpc_free_client(struct rpc_clnt *clnt)
		rpc_unregister_client(clnt);
		rpc_free_iostats(clnt->cl_metrics);
		clnt->cl_metrics = NULL;
		xprt_put(rcu_dereference_raw(clnt->cl_xprt));
		xprt_iter_destroy(&clnt->cl_xpi);
		put_cred(clnt->cl_cred);
		rpc_free_clid(clnt);

Admin message