NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

Send along the already-allocated fattr along with nfs4_fs_locations, and
drop the memcpy of fattr.  We end up growing two more allocations, but this
fixes up a crash as:

PID: 790    TASK: ffff88811b43c000  CPU: 0   COMMAND: "ls"
 #0 [ffffc90000857920] panic at ffffffff81b9bfde
 #1 [ffffc900008579c0] do_trap at ffffffff81023a9b
 #2 [ffffc90000857a10] do_error_trap at ffffffff81023b78
 #3 [ffffc90000857a58] exc_stack_segment at ffffffff81be1f45
 #4 [ffffc90000857a80] asm_exc_stack_segment at ffffffff81c009de
 #5 [ffffc90000857b08] nfs_lookup at ffffffffa0302322 [nfs]
 #6 [ffffc90000857b70] __lookup_slow at ffffffff813a4a5f
 #7 [ffffc90000857c60] walk_component at ffffffff813a86c4
 #8 [ffffc90000857cb8] path_lookupat at ffffffff813a9553
 #9 [ffffc90000857cf0] filename_lookup at ffffffff813ab86b

Suggested-by: Trond Myklebust <trondmy@hammerspace.com>
Fixes: cf221e7c5e8d ("NFS: Remove the label from the nfs4_lookup_res struct")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 3680c8da510c9787bcbae896a292a2cfec039469..f2dbf904c59895b7e6c4f13fd595a50c98164657 100644 (file)
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -417,6 +417,9 @@ static int nfs_do_refmount(struct fs_context *fc, struct rpc_clnt *client)
        fs_locations = kmalloc(sizeof(struct nfs4_fs_locations), GFP_KERNEL);
        if (!fs_locations)
                goto out_free;
+       fs_locations->fattr = nfs_alloc_fattr();
+       if (!fs_locations->fattr)
+               goto out_free_2;
 
        /* Get locations */
        dentry = ctx->clone_data.dentry;
@@ -427,14 +430,16 @@ static int nfs_do_refmount(struct fs_context *fc, struct rpc_clnt *client)
        err = nfs4_proc_fs_locations(client, d_inode(parent), &dentry->d_name, fs_locations, page);
        dput(parent);
        if (err != 0)
-               goto out_free_2;
+               goto out_free_3;
 
        err = -ENOENT;
        if (fs_locations->nlocations <= 0 ||
            fs_locations->fs_path.ncomponents <= 0)
-               goto out_free_2;
+               goto out_free_3;
 
        err = nfs_follow_referral(fc, fs_locations);
+out_free_3:
+       kfree(fs_locations->fattr);
 out_free_2:
        kfree(fs_locations);
 out_free:

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 0dfdbb406f96940369634bea20d73b2a5ef31713..337609befd1789894c5b5543b856dc4d810d465d 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4247,6 +4247,8 @@ static int nfs4_get_referral(struct rpc_clnt *client, struct inode *dir,
        if (locations == NULL)
                goto out;
 
+       locations->fattr = fattr;
+
        status = nfs4_proc_fs_locations(client, dir, name, locations, page);
        if (status != 0)
                goto out;
@@ -4256,17 +4258,14 @@ static int nfs4_get_referral(struct rpc_clnt *client, struct inode *dir,
         * referral.  Cause us to drop into the exception handler, which
         * will kick off migration recovery.
         */
-       if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) {
+       if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &fattr->fsid)) {
                dprintk("%s: server did not return a different fsid for"
                        " a referral at %s\n", __func__, name->name);
                status = -NFS4ERR_MOVED;
                goto out;
        }
        /* Fixup attributes for the nfs_lookup() call to nfs_fhget() */
-       nfs_fixup_referral_attributes(&locations->fattr);
-
-       /* replace the lookup nfs_fattr with the locations nfs_fattr */
-       memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr));
+       nfs_fixup_referral_attributes(fattr);
        memset(fhandle, 0, sizeof(struct nfs_fh));
 out:
        if (page)
@@ -7979,7 +7978,7 @@ static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
        else
                bitmask[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
 
-       nfs_fattr_init(&fs_locations->fattr);
+       nfs_fattr_init(fs_locations->fattr);
        fs_locations->server = server;
        fs_locations->nlocations = 0;
        status = nfs4_call_sync(client, server, &msg, &args.seq_args, &res.seq_res, 0);
@@ -8044,7 +8043,7 @@ static int _nfs40_proc_get_locations(struct nfs_server *server,
        unsigned long now = jiffies;
        int status;
 
-       nfs_fattr_init(&locations->fattr);
+       nfs_fattr_init(locations->fattr);
        locations->server = server;
        locations->nlocations = 0;
 
@@ -8109,7 +8108,7 @@ static int _nfs41_proc_get_locations(struct nfs_server *server,
        };
        int status;
 
-       nfs_fattr_init(&locations->fattr);
+       nfs_fattr_init(locations->fattr);
        locations->server = server;
        locations->nlocations = 0;
 

diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 775c58def32c3e52aba49da448cff03ab7e5ed7a..2540b35ec1870793d067dd915f4d37c834c0b7a9 100644 (file)
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2116,6 +2116,11 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred
                dprintk("<-- %s: no memory\n", __func__);
                goto out;
        }
+       locations->fattr = nfs_alloc_fattr();
+       if (locations->fattr == NULL) {
+               dprintk("<-- %s: no memory\n", __func__);
+               goto out;
+       }
 
        inode = d_inode(server->super->s_root);
        result = nfs4_proc_get_locations(server, NFS_FH(inode), locations,
@@ -2130,7 +2135,7 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred
        if (!locations->nlocations)
                goto out;
 
-       if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
+       if (!(locations->fattr->valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
                dprintk("<-- %s: No fs_locations data, migration skipped\n",
                        __func__);
                goto out;
@@ -2155,6 +2160,8 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred
 out:
        if (page != NULL)
                __free_page(page);
+       if (locations != NULL)
+               kfree(locations->fattr);
        kfree(locations);
        if (result) {
                pr_err("NFS: migration recovery failed (server %s)\n",

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 0b41e00e754f0b34e1bcbc1f8e70d7fa1ba275ff..acfe5f4bda480ab79edb09cc940ecf6ca613ecad 100644 (file)
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -7080,7 +7080,7 @@ static int nfs4_xdr_dec_fs_locations(struct rpc_rqst *req,
        if (res->migration) {
                xdr_enter_page(xdr, PAGE_SIZE);
                status = decode_getfattr_generic(xdr,
-                                       &res->fs_locations->fattr,
+                                       res->fs_locations->fattr,
                                         NULL, res->fs_locations,
                                         res->fs_locations->server);
                if (status)
@@ -7093,7 +7093,7 @@ static int nfs4_xdr_dec_fs_locations(struct rpc_rqst *req,
                        goto out;
                xdr_enter_page(xdr, PAGE_SIZE);
                status = decode_getfattr_generic(xdr,
-                                       &res->fs_locations->fattr,
+                                       res->fs_locations->fattr,
                                         NULL, res->fs_locations,
                                         res->fs_locations->server);
        }

diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 4a8ba84f848ee40e95ec8c3d1132edf93b34b321..0e3aa0f5f324d4f24339b73e7c15e287c2855a43 100644 (file)
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1222,7 +1222,7 @@ struct nfs4_fs_location {
 
 #define NFS4_FS_LOCATIONS_MAXENTRIES 10
 struct nfs4_fs_locations {
-       struct nfs_fattr fattr;
+       struct nfs_fattr *fattr;
        const struct nfs_server *server;
        struct nfs4_pathname fs_path;
        int nlocations;