From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590831; b=Afcb/jJrP+x2XFF4PfCparau02ygleBVR5qbxBmsf9iYbu1QY4Rcsb52BcE1VMgnQld5 qqI5XxVu7uThInp+L6Fk3/gTcIQZDGZOomr5AC6/lEwO2vzrY5dutHDG/7DKKMRHLQptm 5zXKYNddceGCBLvYNgXeMydeR4QCDbf1+DcdzXB5551vilhBI1tsDeXqjoO5NsszC/YTF bdBBpzx370YD1C9INlLCO0HnDvpLjKC8L8b4gHCwqkdpFl0yEsJPZ3Hb163CBQEwLWkZr gbytNfkvxp51VJEhtKjEhnAelTdFYtAOjz5blJdVUf+v3RrzgczPMRwxoq2PKN6Cg3g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590831; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=YjYqR+fHL/cXtUIHgIKhEm87r5je7FH+O6F86jLSWJU=; b=EHnsDjHUOvmB8wIeq/WdGVBIxCgSOIXHbf+5E/pfjKsr56IodyYp+pRkJV02v6L4G6bq N086KI2KqNl5VFIgGANyY2mV/Lxyym7MyZkZfGfpGORPxelAs8SLEH0tq9D51ix6JyEEr LQaGaT8/scpzzxBzWPdbUKx3mEumGsNxBFx+hkhShvYxEgVx5Ckf0/AVhVg2WE9MOXqZD I4sSq0V27knK0GGghKInbpZ4vButWG/P9cYj2TNBIZhagPfPyCThXDmjK3FykYTyGVVPL vrd5Csz5wi5ygDPJhA5IBoLBMCYMTwl7WyP2CidE3NPTTN9LcuJicwpk1FAZ6kSzKcg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=F+qEAEBQ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEC6F606D487; Fri, 13 Nov 2026 17:27:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=F+qEAEBQ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A9101F000C5; Fri, 13 Nov 2026 17:27:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590830; bh=YjYqR+fHL/cXtUIHgIKhEm87r5je7FH+O6F86jLSWJU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=F+qEAEBQDrK3dSMdU+J59HOxcPdKsuZul+taJe/ULsxofL3JCmAXsUdl7lNzpU5iD vl3FAeisS6V4YmYoZG3F1LenJe74ssKimjC9z64UcbfmcImPgUm7zIua4xi6Hm2DZS CwSbNx8stINXN4sRILZrIUduvW7i6zbkiqRk7Kgk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+d5c77cabf7a3492aa650@syzkaller.appspotmail.com, Chuck Lever , Sasha Levin Subject: [PATCH 6.12 035/670] NFSD: Move the cld upcall message out of the callers stack frame Date: Fri, 13 Nov 2026 10:43:19 -0500 Message-ID: <20261113153812.345036660@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chuck Lever [ Upstream commit c559b05610557fa3c6c30259261f6dae523b3f23 ] __cld_pipe_upcall() builds its struct rpc_pipe_msg on the stack and hands it to rpc_queue_upcall(), which links it into a list the pipe owns until the message is released. Only the completion rules keep that frame alive for as long as the pipe refers to it, and the peer that drives those rules is an untrusted userspace daemon. The gss and idmap upcalls do not take that on: each keeps the message in the object it already allocates. Do the same here and put the message in struct cld_upcall, beside the reply buffer it carries. cld_pipe_destroy_msg() then reaches the upcall from the message directly rather than through msg->data. Reported-by: syzbot+d5c77cabf7a3492aa650@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d5c77cabf7a3492aa650 Link: https://patch.msgid.link/20260901-alemi-v2-2-e163f94a3a6e@kernel.org Signed-off-by: Chuck Lever Stable-dep-of: 2a83fcb50f3c ("NFSD: Complete a cld upcall when the daemon closes the pipe") Signed-off-by: Sasha Levin --- fs/nfsd/nfs4recover.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c index 104dafbe881bc..b493bb059a8b0 100644 --- a/fs/nfsd/nfs4recover.c +++ b/fs/nfsd/nfs4recover.c @@ -730,6 +730,7 @@ struct cld_upcall { struct completion cu_done; /* daemon has read the whole upcall; protected by cn_lock */ bool cu_inflight; + struct rpc_pipe_msg cu_pipe_msg; union { struct cld_msg_hdr cu_hdr; struct cld_msg cu_msg; @@ -741,22 +742,22 @@ static int __cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn) { int ret; - struct rpc_pipe_msg msg; struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_u); + struct rpc_pipe_msg *msg = &cup->cu_pipe_msg; - memset(&msg, 0, sizeof(msg)); - msg.data = cmsg; - msg.len = nn->client_tracking_ops->msglen; + memset(msg, 0, sizeof(*msg)); + msg->data = cmsg; + msg->len = nn->client_tracking_ops->msglen; - ret = rpc_queue_upcall(pipe, &msg); + ret = rpc_queue_upcall(pipe, msg); if (ret < 0) { goto out; } wait_for_completion(&cup->cu_done); - if (msg.errno < 0) - ret = msg.errno; + if (msg->errno < 0) + ret = msg->errno; out: return ret; } @@ -929,9 +930,8 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) static void cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) { - struct cld_msg *cmsg = msg->data; - struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, - cu_u.cu_msg); + struct cld_upcall *cup = container_of(msg, struct cld_upcall, + cu_pipe_msg); struct cld_net *cn = cup->cu_net; /* -- 2.53.0