• Al Viro's avatar
    nfs: fix UAF on pathwalk running into umount · c1b967d0
    Al Viro authored
    NFS ->d_revalidate(), ->permission() and ->get_link() need to access
    some parts of nfs_server when called in RCU mode:
    	server->flags
    	server->caps
    	*(server->io_stats)
    and, worst of all, call
    	server->nfs_client->rpc_ops->have_delegation
    (the last one - as NFS_PROTO(inode)->have_delegation()).  We really
    don't want to RCU-delay the entire nfs_free_server() (it would have
    to be done with schedule_work() from RCU callback, since it can't
    be made to run from interrupt context), but actual freeing of
    nfs_server and ->io_stats can be done via call_rcu() just fine.
    nfs_client part is handled simply by making nfs_free_client() use
    kfree_rcu().
    Acked-by: default avatarChristian Brauner <brauner@kernel.org>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    c1b967d0
client.c 36.1 KB