From 899df06270730fcd9188651d76005ecd9aea3f66 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Mon, 30 Dec 2024 14:31:04 +0800 Subject: [PATCH 1/2] NFSD: Prevent NULL dereference in nfsd4_process_cb_update() stable inclusion from stable-v5.10.231 commit 752a75811f27300fe8131b0a1efc91960f6f88e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAET CVE: CVE-2024-53217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=752a75811f27300fe8131b0a1efc91960f6f88e7 -------------------------------- [ Upstream commit 1e02c641c3a43c88cecc08402000418e15578d38 ] @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault. Fixes: dcbeaa68dbbd ("nfsd4: allow backchannel recovery") Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Signed-off-by: Sasha Levin Signed-off-by: Li Lingfeng --- fs/nfsd/nfs4callback.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index bd79fc4934f0f..ec7daabc3548c 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1304,6 +1304,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) ses = c->cn_session; } spin_unlock(&clp->cl_lock); + if (!c) + return; err = setup_callback_client(clp, &conn, ses); if (err) { -- Gitee From 23396191f74b3359926e5ef3e9b6294638d3db39 Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Mon, 30 Dec 2024 14:31:05 +0800 Subject: [PATCH 2/2] nfsd: restore callback functionality for NFSv4.0 mainline inclusion from mainline-v6.13-rc5 commit 7917f01a286ce01e9c085e24468421f596ee1a0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAET CVE: CVE-2024-53217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7917f01a286ce01e9c085e24468421f596ee1a0c -------------------------------- A recent patch inadvertently broke callbacks for NFSv4.0. In the 4.0 case we do not expect a session to be found but still need to call setup_callback_client() which will not try to dereference it. This patch moves the check for failure to find a session into the 4.1+ branch of setup_callback_client() Fixes: 1e02c641c3a4 ("NFSD: Prevent NULL dereference in nfsd4_process_cb_update()") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Signed-off-by: Li Lingfeng --- fs/nfsd/nfs4callback.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index ec7daabc3548c..431598c11fcf8 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -915,7 +915,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c args.authflavor = clp->cl_cred.cr_flavor; clp->cl_cb_ident = conn->cb_ident; } else { - if (!conn->cb_xprt) + if (!conn->cb_xprt || !ses) return -EINVAL; clp->cl_cb_session = ses; args.bc_xprt = conn->cb_xprt; @@ -1304,8 +1304,6 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) ses = c->cn_session; } spin_unlock(&clp->cl_lock); - if (!c) - return; err = setup_callback_client(clp, &conn, ses); if (err) { -- Gitee