From nobody Tue Feb 22 22:24:20 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id E1F9619DD5AA; Tue, 22 Feb 2022 22:24:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K3DH862PQz3Fgt; Tue, 22 Feb 2022 22:24:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645568660; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OYTYKbpaDSbKCdcZ8lFQJ4R4oIuSb5CgT8zgGIwwIgA=; b=OIPcDqlY7g1bWqtsrYkjeOQWjfqYdPjLi2X4MxMGEmFc3DeGbANXrlv9nc6I9ealNMUl2S v7hEm+oJP9w4ExMS1I/YOTR4KZiMZA2pmPrftSMqKZ3wNkUFKgTvmeUTzdswO6bBksFMmf upj2omUPSt/MBdq1PUOwEdbvndPB6ZLQIgPxldb2JLir0f8wMrvGvVzBlUKBa3A7+Y703l QtV959V7GnW+vJL23WghUS5s9kjaj01rGdLDTr0Y2IOzTonCGFLjCv8pBE4rZjoyu57lPL wNDDVYpcJyDQDsfd46h/FO8qpPQp806bEnlZN/PLNGA9ruxeo+k7bN31gcJ+eg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id AEE964A85; Tue, 22 Feb 2022 22:24:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 21MMOKSA027153; Tue, 22 Feb 2022 22:24:20 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 21MMOK1I027152; Tue, 22 Feb 2022 22:24:20 GMT (envelope-from git) Date: Tue, 22 Feb 2022 22:24:20 GMT Message-Id: <202202222224.21MMOK1I027152@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: dd08b84e35b6 - main - nfscl: Fix a use after free in nfscl_cleanupkext() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: dd08b84e35b6fdee0df5fd0e0533cd361dec71cb Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1645568660; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OYTYKbpaDSbKCdcZ8lFQJ4R4oIuSb5CgT8zgGIwwIgA=; b=gzhxBfaYNUzYQtqNyrwJsmHBLcfq6yHa7XX3yoH6ahS7Lg9JNLnXw0ah/YtOqoasgPZbkA Jz6wdanbokD1ZpzevcGy4Hbesx0Fz8r4XfwkO+57zKbn+9YuOUSu9CXghaZjuGMty1QiN5 99I+uZqTHWTyxvpq10gIdPFk8eB21HiPGyb8nVCud9cvUd25KIVkL401LObWEUuRdYkFkN 8eqB8gqGme9W8L4dKqHAMs05DpLImJ6fGD5phTGqNG6A4OvQmNuU0iCyQ05diQ2XuV2SeV ynU4SUj1dKYOOd7BcwNqSLUec0nle43DI/qqMmGZI0QFgsorxMHqsp6kd3UaPA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1645568660; a=rsa-sha256; cv=none; b=TJgoAcmohV5or0PARLRkleXdlHagQXc/zL+PuS6JGtjlZQcdb+Ao2z/8W13I+GEcLaS9VM vjx7aTI1/GwPY4GHVz2K0CjfqwM0DeqkiTu8ulIoJVuuO3PUvjST3PY15vbAbFQECFgX/6 BEM34R0kzMxKCGiRR1lPpHwI7TRnhvrj0geHOowgYUEl7clndFR+XEjAmzs14XlGJEDZ8c Az7LGWeEF6IKcw5VejRlwLQow6jjus/MkLVs/feNB6ZNVpJdyJkpvkq5EUydM1ApHEggWn PCVnh4IdSo4Qf0G4IU3lJK4ET/9I8EPxQF1dWp7M5PiJ+M7lgAMwlkAbOVrxag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=dd08b84e35b6fdee0df5fd0e0533cd361dec71cb commit dd08b84e35b6fdee0df5fd0e0533cd361dec71cb Author: Rick Macklem AuthorDate: 2022-02-22 22:21:43 +0000 Commit: Rick Macklem CommitDate: 2022-02-22 22:21:43 +0000 nfscl: Fix a use after free in nfscl_cleanupkext() ler@, markj@ reported a use after free in nfscl_cleanupkext(). They also provided two possible causes: - In nfscl_cleanup_common(), "own" is the owner string owp->nfsow_owner. If we free that particular owner structure, than in subsequent comparisons "own" will point to freed memory. - nfscl_cleanup_common() can free more than one owner, so the use of LIST_FOREACH_SAFE() in nfscl_cleanupkext() is not sufficient. I also believe there is a 3rd: - If nfscl_freeopenowner() or nfscl_freelockowner() is called without the NFSCLSTATE mutex held, this could race with nfscl_cleanupkext(). This could happen when the exclusive lock is held on the client, such as when delegations are being returned. This patch fixes them as follows: 1 - Copy the owner string to a local variable before the nfscl_cleanup_common() call. 2 - Modify nfscl_cleanup_common() to return whether or not a free was done. When a free was done, do a goto to restart the loop, instead of using FOREACH_SAFE, which was not safe in this case. 3 - Acquire the NFSCLSTATE mutex in nfscl_freeopenowner() and nfscl_freelockowner(), if it not already held. This serializes all of these calls with the ones done in nfscl_cleanup_common(). Reported by: ler Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D34334 --- sys/fs/nfsclient/nfs_clstate.c | 70 +++++++++++++++++++++++++++++++++++------- 1 file changed, 59 insertions(+), 11 deletions(-) diff --git a/sys/fs/nfsclient/nfs_clstate.c b/sys/fs/nfsclient/nfs_clstate.c index 5262986645cd..c37ff8a8ab11 100644 --- a/sys/fs/nfsclient/nfs_clstate.c +++ b/sys/fs/nfsclient/nfs_clstate.c @@ -158,7 +158,7 @@ static int nfsrpc_reopen(struct nfsmount *, u_int8_t *, int, u_int32_t, static void nfscl_freedeleg(struct nfscldeleghead *, struct nfscldeleg *, bool); static int nfscl_errmap(struct nfsrv_descript *, u_int32_t); -static void nfscl_cleanup_common(struct nfsclclient *, u_int8_t *); +static u_int nfscl_cleanup_common(struct nfsclclient *, u_int8_t *); static int nfscl_recalldeleg(struct nfsclclient *, struct nfsmount *, struct nfscldeleg *, vnode_t, struct ucred *, NFSPROC_T *, int, vnode_t *); @@ -1642,8 +1642,21 @@ nfscl_expireopen(struct nfsclclient *clp, struct nfsclopen *op, static void nfscl_freeopenowner(struct nfsclowner *owp, int local) { + int owned; + /* + * Make sure the NFSCLSTATE mutex is held, to avoid races with + * calls in nfscl_renewthread() that do not hold a reference + * count on the nfsclclient and just the mutex. + * The mutex will not be held for calls done with the exclusive + * nfsclclient lock held. + */ + owned = mtx_owned(NFSCLSTATEMUTEXPTR); + if (owned == 0) + NFSLOCKCLSTATE(); LIST_REMOVE(owp, nfsow_list); + if (owned == 0) + NFSUNLOCKCLSTATE(); free(owp, M_NFSCLOWNER); if (local) nfsstatsv1.cllocalopenowners--; @@ -1658,8 +1671,21 @@ void nfscl_freelockowner(struct nfscllockowner *lp, int local) { struct nfscllock *lop, *nlop; + int owned; + /* + * Make sure the NFSCLSTATE mutex is held, to avoid races with + * calls in nfscl_renewthread() that do not hold a reference + * count on the nfsclclient and just the mutex. + * The mutex will not be held for calls done with the exclusive + * nfsclclient lock held. + */ + owned = mtx_owned(NFSCLSTATEMUTEXPTR); + if (owned == 0) + NFSLOCKCLSTATE(); LIST_REMOVE(lp, nfsl_list); + if (owned == 0) + NFSUNLOCKCLSTATE(); LIST_FOREACH_SAFE(lop, &lp->nfsl_lock, nfslo_list, nlop) { nfscl_freelock(lop, local); } @@ -1841,17 +1867,24 @@ nfscl_expireclient(struct nfsclclient *clp, struct nfsmount *nmp, } } +#define FREED_OPENOWNER 0x1 +#define FREED_LOCKOWNER 0x2 + /* * This function must be called after the process represented by "own" has * exited. Must be called with CLSTATE lock held. + * Return the FREED_xxx flag bits, since the caller needs to know if either + * the open owner or lock owner lists have changed. */ -static void +static u_int nfscl_cleanup_common(struct nfsclclient *clp, u_int8_t *own) { struct nfsclowner *owp, *nowp; struct nfscllockowner *lp, *nlp; struct nfscldeleg *dp; + u_int didfree; + didfree = 0; /* First, get rid of local locks on delegations. */ TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) { LIST_FOREACH_SAFE(lp, &dp->nfsdl_lock, nfsl_list, nlp) { @@ -1859,6 +1892,7 @@ nfscl_cleanup_common(struct nfsclclient *clp, u_int8_t *own) if ((lp->nfsl_rwlock.nfslock_lock & NFSV4LOCK_WANTED)) panic("nfscllckw"); nfscl_freelockowner(lp, 1); + didfree |= FREED_LOCKOWNER; } } } @@ -1873,13 +1907,15 @@ nfscl_cleanup_common(struct nfsclclient *clp, u_int8_t *own) * here. For that case, let the renew thread clear * out the OpenOwner later. */ - if (LIST_EMPTY(&owp->nfsow_open)) + if (LIST_EMPTY(&owp->nfsow_open)) { nfscl_freeopenowner(owp, 0); - else + didfree |= FREED_OPENOWNER; + } else owp->nfsow_defunct = 1; } owp = nowp; } + return (didfree); } /* @@ -1888,10 +1924,11 @@ nfscl_cleanup_common(struct nfsclclient *clp, u_int8_t *own) static void nfscl_cleanupkext(struct nfsclclient *clp, struct nfscllockownerfhhead *lhp) { - struct nfsclowner *owp, *nowp; + struct nfsclowner *owp; struct nfsclopen *op; struct nfscllockowner *lp, *nlp; struct nfscldeleg *dp; + uint8_t own[NFSV4CL_LOCKNAMELEN]; /* * All the pidhash locks must be acquired, since they are sx locks @@ -1901,15 +1938,20 @@ nfscl_cleanupkext(struct nfsclclient *clp, struct nfscllockownerfhhead *lhp) */ pidhash_slockall(); NFSLOCKCLSTATE(); - LIST_FOREACH_SAFE(owp, &clp->nfsc_owner, nfsow_list, nowp) { +tryagain: + LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) { LIST_FOREACH(op, &owp->nfsow_open, nfso_list) { LIST_FOREACH_SAFE(lp, &op->nfso_lock, nfsl_list, nlp) { if (LIST_EMPTY(&lp->nfsl_lock)) nfscl_emptylockowner(lp, lhp); } } - if (nfscl_procdoesntexist(owp->nfsow_owner)) - nfscl_cleanup_common(clp, owp->nfsow_owner); + if (nfscl_procdoesntexist(owp->nfsow_owner)) { + memcpy(own, owp->nfsow_owner, NFSV4CL_LOCKNAMELEN); + if ((nfscl_cleanup_common(clp, own) & + FREED_OPENOWNER) != 0) + goto tryagain; + } } /* @@ -1920,9 +1962,15 @@ nfscl_cleanupkext(struct nfsclclient *clp, struct nfscllockownerfhhead *lhp) * nfscl_cleanup_common(). */ TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) { - LIST_FOREACH_SAFE(lp, &dp->nfsdl_lock, nfsl_list, nlp) { - if (nfscl_procdoesntexist(lp->nfsl_owner)) - nfscl_cleanup_common(clp, lp->nfsl_owner); +tryagain2: + LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) { + if (nfscl_procdoesntexist(lp->nfsl_owner)) { + memcpy(own, lp->nfsl_owner, + NFSV4CL_LOCKNAMELEN); + if ((nfscl_cleanup_common(clp, own) & + FREED_LOCKOWNER) != 0) + goto tryagain2; + } } } NFSUNLOCKCLSTATE();