linux-sg2042/net/sunrpc
NeilBrown ed2849d3ec sunrpc: prevent use-after-free on clearing XPT_BUSY
When an xprt is created, it has a refcount of 1, and XPT_BUSY is set.
The refcount is *not* owned by the thread that created the xprt
(as is clear from the fact that creators never put the reference).
Rather, it is owned by the absence of XPT_DEAD.  Once XPT_DEAD is set,
(And XPT_BUSY is clear) that initial reference is dropped and the xprt
can be freed.

So when a creator clears XPT_BUSY it is dropping its only reference and
so must not touch the xprt again.

However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY
reference on a new xprt), calls svc_xprt_recieved.  This clears
XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.
This is dangerous and has been seen to leave svc_xprt_enqueue working
with an xprt containing garbage.

So we need to hold an extra counted reference over that call to
svc_xprt_received.

For safety, any time we clear XPT_BUSY and then use the xprt again, we
first get a reference, and the put it again afterwards.

Note that svc_close_all does not need this extra protection as there are
no threads running, and the final free can only be called asynchronously
from such a thread.

Signed-off-by: NeilBrown <neilb@suse.de>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2010-12-07 20:39:55 -05:00
..
auth_gss Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux 2010-10-26 09:55:25 -07:00
xprtrdma sunrpc/xprtrdma: clean up workqueue usage 2010-10-21 10:11:45 -04:00
Kconfig nfsd4: remove spkm3 2010-10-01 18:09:55 -04:00
Makefile SUNRPC: Provide functions for managing universal addresses 2009-08-09 15:09:34 -04:00
addr.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
auth.c Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux 2010-10-26 09:55:25 -07:00
auth_generic.c sunrpc: fix up rpcauth_remove_module section mismatch 2010-09-29 12:27:37 -04:00
auth_null.c SUNRPC: Move the bound cred to struct rpc_rqst 2010-08-04 08:54:09 -04:00
auth_unix.c SUNRPC: Move the bound cred to struct rpc_rqst 2010-08-04 08:54:09 -04:00
backchannel_rqst.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
bc_svc.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
cache.c Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux 2010-10-26 09:55:25 -07:00
clnt.c SUNRPC: Fix an infinite loop in call_refresh/call_refreshresult 2010-11-22 13:22:39 -05:00
netns.h sunrpc: Make the ip_map_cache be per-net 2010-09-27 10:16:12 -04:00
rpc_pipe.c convert get_sb_single() users 2010-10-29 04:16:28 -04:00
rpcb_clnt.c Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux 2010-10-26 09:55:25 -07:00
sched.c Merge branch 'nfs-for-2.6.37' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 2010-10-25 13:48:29 -07:00
socklib.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
stats.c SUNRPC: Simplify rpc_alloc_iostats by removing pointless local variable 2010-11-16 11:58:51 -05:00
sunrpc.h nfsd41: sunrpc: Added rpc server-side backchannel handling 2009-09-11 15:04:16 -04:00
sunrpc_syms.c sunrpc: Make the ip_map_cache be per-net 2010-09-27 10:16:12 -04:00
svc.c sunrpc: close connection when a request is irretrievably lost. 2010-09-21 16:57:49 -04:00
svc_xprt.c sunrpc: prevent use-after-free on clearing XPT_BUSY 2010-12-07 20:39:55 -05:00
svcauth.c net: Move && and || to end of previous line 2009-11-29 16:55:45 -08:00
svcauth_unix.c sunrpc: Use helper to set v4 mapped addr in ip_map_parse 2010-10-11 20:00:17 -04:00
svcsock.c svcrpc: svc_tcp_sendto XPT_DEAD check is redundant 2010-10-25 17:59:34 -04:00
sysctl.c sysctl: Drop & in front of every proc_handler. 2009-11-18 08:37:40 -08:00
timer.c SUNRPC: Add documenting comments in net/sunrpc/timer.c 2009-08-09 15:09:47 -04:00
xdr.c SUNRPC: Add a helper function xdr_inline_peek 2010-10-23 15:27:32 -04:00
xprt.c sunrpc: Turn list_for_each-s into the ..._entry-s 2010-10-19 10:48:16 -04:00
xprtsock.c Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux 2010-10-26 09:55:25 -07:00