Commit 64bed6cb authored by Amir Goldstein's avatar Amir Goldstein Committed by J. Bruce Fields
Browse files

nfsd: fix leaked file lock with nfs exported overlayfs 

nfsd and lockd call vfs_lock_file() to lock/unlock the inode
returned by locks_inode(file).

Many places in nfsd/lockd code use the inode returned by
file_inode(file) for lock manipulation. With Overlayfs, file_inode()
(the underlying inode) is not the same object as locks_inode() (the
overlay inode). This can result in "Leaked POSIX lock" messages
and eventually to a kernel crash as reported by Eddie Horng:
https://marc.info/?l=linux-unionfs&m=153086643202072&w=2



Fix all the call sites in nfsd/lockd that should use locks_inode().
This is a correctness bug that manifested when overlayfs gained
NFS export support in v4.16.

Reported-by: default avatarEddie Horng <eddiehorng.tw@gmail.com>
Tested-by: default avatarEddie Horng <eddiehorng.tw@gmail.com>
Cc: Jeff Layton <jlayton@kernel.org>
Fixes: 8383f174 ("ovl: wire up NFS export operations")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 8163496e

fs/lockd/clntlock.c

+1 −1
Original line number Diff line number Diff line
@@ -187,7 +187,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock) 
			continue;

		if (!rpc_cmp_addr(nlm_addr(block->b_host), addr))

			continue;

		if (nfs_compare_fh(NFS_FH(file_inode(fl_blocked->fl_file)) ,fh) != 0)

		if (nfs_compare_fh(NFS_FH(locks_inode(fl_blocked->fl_file)), fh) != 0)

			continue;

		/* Alright, we found a lock. Set the return status

		 * and wake up the caller

fs/lockd/clntproc.c

+1 −1
Original line number Diff line number Diff line
@@ -128,7 +128,7 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl) 
	char *nodename = req->a_host->h_rpcclnt->cl_nodename;



	nlmclnt_next_cookie(&argp->cookie);

	memcpy(&lock->fh, NFS_FH(file_inode(fl->fl_file)), sizeof(struct nfs_fh));

	memcpy(&lock->fh, NFS_FH(locks_inode(fl->fl_file)), sizeof(struct nfs_fh));

	lock->caller  = nodename;

	lock->oh.data = req->a_owner;

	lock->oh.len  = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s",

fs/lockd/svclock.c

+8 −8
Original line number Diff line number Diff line
@@ -405,8 +405,8 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file, 
	__be32			ret;



	dprintk("lockd: nlmsvc_lock(%s/%ld, ty=%d, pi=%d, %Ld-%Ld, bl=%d)\n",

				file_inode(file->f_file)->i_sb->s_id,

				file_inode(file->f_file)->i_ino,

				locks_inode(file->f_file)->i_sb->s_id,

				locks_inode(file->f_file)->i_ino,

				lock->fl.fl_type, lock->fl.fl_pid,

				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end,
@@ -511,8 +511,8 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, 
	__be32			ret;



	dprintk("lockd: nlmsvc_testlock(%s/%ld, ty=%d, %Ld-%Ld)\n",

				file_inode(file->f_file)->i_sb->s_id,

				file_inode(file->f_file)->i_ino,

				locks_inode(file->f_file)->i_sb->s_id,

				locks_inode(file->f_file)->i_ino,

				lock->fl.fl_type,

				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);
@@ -566,8 +566,8 @@ nlmsvc_unlock(struct net *net, struct nlm_file *file, struct nlm_lock *lock) 
	int	error;



	dprintk("lockd: nlmsvc_unlock(%s/%ld, pi=%d, %Ld-%Ld)\n",

				file_inode(file->f_file)->i_sb->s_id,

				file_inode(file->f_file)->i_ino,

				locks_inode(file->f_file)->i_sb->s_id,

				locks_inode(file->f_file)->i_ino,

				lock->fl.fl_pid,

				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);
@@ -595,8 +595,8 @@ nlmsvc_cancel_blocked(struct net *net, struct nlm_file *file, struct nlm_lock *l 
	int status = 0;



	dprintk("lockd: nlmsvc_cancel(%s/%ld, pi=%d, %Ld-%Ld)\n",

				file_inode(file->f_file)->i_sb->s_id,

				file_inode(file->f_file)->i_ino,

				locks_inode(file->f_file)->i_sb->s_id,

				locks_inode(file->f_file)->i_ino,

				lock->fl.fl_pid,

				(long long)lock->fl.fl_start,

				(long long)lock->fl.fl_end);

fs/lockd/svcsubs.c

+2 −2
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ static inline void nlm_debug_print_fh(char *msg, struct nfs_fh *f) 


static inline void nlm_debug_print_file(char *msg, struct nlm_file *file)

{

	struct inode *inode = file_inode(file->f_file);

	struct inode *inode = locks_inode(file->f_file);



	dprintk("lockd: %s %s/%ld\n",

		msg, inode->i_sb->s_id, inode->i_ino);
@@ -414,7 +414,7 @@ nlmsvc_match_sb(void *datap, struct nlm_file *file) 
{

	struct super_block *sb = datap;



	return sb == file_inode(file->f_file)->i_sb;

	return sb == locks_inode(file->f_file)->i_sb;

}



/**

fs/nfsd/nfs4state.c

+1 −1
Original line number Diff line number Diff line
@@ -6322,7 +6322,7 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) 
		return status;

	}



	inode = file_inode(filp);

	inode = locks_inode(filp);

	flctx = inode->i_flctx;



	if (flctx && !list_empty_careful(&flctx->flc_posix)) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE