race of lockd inetaddr notifiers vs nlmsvc_rqst change
authorVasily Averin <vvs@virtuozzo.com>
Fri, 10 Nov 2017 07:19:26 +0000 (10:19 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 3 Feb 2018 16:39:08 +0000 (17:39 +0100)
commit156c80d4e197be386103a0ead001d14c4492ed3c
tree8750b2cc0732dec8d739d7110976ff471d7af7a0
parent631db7f3895bd4138a7fb0c02f0db1750c79ee23
race of lockd inetaddr notifiers vs nlmsvc_rqst change

[ Upstream commit 6b18dd1c03e07262ea0866084856b2a3c5ba8d09 ]

lockd_inet[6]addr_event use nlmsvc_rqst without taken nlmsvc_mutex,
nlmsvc_rqst can be changed during execution of notifiers and crash the host.

Patch enables access to nlmsvc_rqst only when it was correctly initialized
and delays its cleanup until notifiers are no longer in use.

Note that nlmsvc_rqst can be temporally set to ERR_PTR, so the "if
(nlmsvc_rqst)" check in notifiers is insufficient on its own.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Tested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/lockd/svc.c