* [PATCH 1/1] nfsd: fix __fh_verify for localio
@ 2025-01-28 16:58 Olga Kornievskaia
2025-01-28 17:05 ` cel
2025-01-28 17:10 ` Jeff Layton
0 siblings, 2 replies; 3+ messages in thread
From: Olga Kornievskaia @ 2025-01-28 16:58 UTC (permalink / raw)
To: chuck.lever, jlayton; +Cc: linux-nfs, neilb, Dai.Ngo, tom, Olga Kornievskaia
__fh_verify() added a call to svc_xprt_set_valid() to help do connection
management but during LOCALIO path rqstp argument is NULL, leading to
NULL pointer dereferencing and a crash.
Fixes: eccbbc7c00a5 ("nfsd: don't use sv_nrthreads in connection limiting calculations.")
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
---
fs/nfsd/nfsfh.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index bf59f83c6224..91bf0e6d5895 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -381,8 +381,9 @@ __fh_verify(struct svc_rqst *rqstp,
error = check_nfsd_access(exp, rqstp, may_bypass_gss);
if (error)
goto out;
-
- svc_xprt_set_valid(rqstp->rq_xprt);
+ /* During LOCALIO call to fh_verify will be called with a NULL rqstp */
+ if (rqstp)
+ svc_xprt_set_valid(rqstp->rq_xprt);
/* Finally, check access permissions. */
error = nfsd_permission(cred, exp, dentry, access);
--
2.47.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH 1/1] nfsd: fix __fh_verify for localio
2025-01-28 16:58 [PATCH 1/1] nfsd: fix __fh_verify for localio Olga Kornievskaia
@ 2025-01-28 17:05 ` cel
2025-01-28 17:10 ` Jeff Layton
1 sibling, 0 replies; 3+ messages in thread
From: cel @ 2025-01-28 17:05 UTC (permalink / raw)
To: jlayton, Olga Kornievskaia; +Cc: Chuck Lever, linux-nfs, neilb, Dai.Ngo, tom
From: Chuck Lever <chuck.lever@oracle.com>
On Tue, 28 Jan 2025 11:58:06 -0500, Olga Kornievskaia wrote:
> __fh_verify() added a call to svc_xprt_set_valid() to help do connection
> management but during LOCALIO path rqstp argument is NULL, leading to
> NULL pointer dereferencing and a crash.
>
>
Applied to nfsd-testing, thanks!
[1/1] nfsd: fix __fh_verify for localio
commit: 3c6a376bcbc815e3bdae0816b32e600c4c63599e
--
Chuck Lever
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 1/1] nfsd: fix __fh_verify for localio
2025-01-28 16:58 [PATCH 1/1] nfsd: fix __fh_verify for localio Olga Kornievskaia
2025-01-28 17:05 ` cel
@ 2025-01-28 17:10 ` Jeff Layton
1 sibling, 0 replies; 3+ messages in thread
From: Jeff Layton @ 2025-01-28 17:10 UTC (permalink / raw)
To: Olga Kornievskaia, chuck.lever; +Cc: linux-nfs, neilb, Dai.Ngo, tom
On Tue, 2025-01-28 at 11:58 -0500, Olga Kornievskaia wrote:
> __fh_verify() added a call to svc_xprt_set_valid() to help do connection
> management but during LOCALIO path rqstp argument is NULL, leading to
> NULL pointer dereferencing and a crash.
>
> Fixes: eccbbc7c00a5 ("nfsd: don't use sv_nrthreads in connection limiting calculations.")
> Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
> ---
> fs/nfsd/nfsfh.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
> index bf59f83c6224..91bf0e6d5895 100644
> --- a/fs/nfsd/nfsfh.c
> +++ b/fs/nfsd/nfsfh.c
> @@ -381,8 +381,9 @@ __fh_verify(struct svc_rqst *rqstp,
> error = check_nfsd_access(exp, rqstp, may_bypass_gss);
> if (error)
> goto out;
> -
> - svc_xprt_set_valid(rqstp->rq_xprt);
> + /* During LOCALIO call to fh_verify will be called with a NULL rqstp */
> + if (rqstp)
> + svc_xprt_set_valid(rqstp->rq_xprt);
>
> /* Finally, check access permissions. */
> error = nfsd_permission(cred, exp, dentry, access);
Nice catch!
Reviewed-by: Jeff Layton <jlayton@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-01-28 17:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-28 16:58 [PATCH 1/1] nfsd: fix __fh_verify for localio Olga Kornievskaia
2025-01-28 17:05 ` cel
2025-01-28 17:10 ` Jeff Layton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox