From: Jeff Layton <jlayton@kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-6.6 is a v6.6-era baseline that lacks the nfsd async-copy prerequisites present in the mainline base (v7.3-rc1): there is no nfsd4_has_active_async_copies(), nfsd4_async_copy_reaper() or nfsd4_cancel_copy_by_sb() to repoint and no cp_ttl reaper, so those hunks do not apply; nfs4_put_copy()/nfsd4_stop_copy()/ nfsd4_unhash_copy() keep OLK-6.6's earlier forms (no task_struct pinning in nfs4_put_copy(), plain cp_clp store, no CB_ERROR/COMPLETED handling) with only the type and cp_copy field paths adjusted; cleanup_async_copy() additionally keeps OLK-6.6's 'if (cp_copy.cp_clp) list_del' block] fs/nfsd/nfs4state.c [nfs4_init_copy_state()/nfs4_free_copy_state() repointed to struct nfsd4_async_copy; nfs4_init_cp_state() keeps the 3-argument form used by OLK-6.6 (mainline's base added a struct nfs4_stid *p_stid param)] fs/nfsd/state.h [forward declaration added for struct nfsd4_async_copy and the two nfs4_*_copy_state() prototypes repointed to it] fs/nfsd/xdr4.h [OLK-6.6's struct nfsd4_copy has no cp_cb_offload, cp_ttl or attr_update (mainline added them in earlier patches), so only copies/copy_task/refcount/cp_stateid move into the new struct nfsd4_async_copy; OLK-6.6 still heap-allocates the CB_OFFLOAD with kzalloc() and uses nfsd4_send_cb_offload(copy, nfserr), so cp_cb_offload is not embedded and nfsd4_cb_offload_release() needs no change] Signed-off-by: Lu Jialin <lujialin4@huawei.com> --- fs/nfsd/nfs4proc.c | 89 ++++++++++++++++++++++++--------------------- fs/nfsd/nfs4state.c | 6 +-- fs/nfsd/state.h | 5 ++- fs/nfsd/xdr4.h | 23 +++++++++--- 4 files changed, 70 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c74aedc1d2c6..ae3ad8afaffd 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,32 +1274,32 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(©->refcount)) return; - atomic_dec(©->cp_nn->pending_async_copies); - kfree(copy->cp_src); + atomic_dec(©->cp_copy.cp_nn->pending_async_copies); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, ©->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, ©->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(©->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(©->copies)) list_del_init(©->copies); } @@ -1309,7 +1309,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1702,7 +1702,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1717,20 +1716,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(©->cp_clp->async_lock); + release_copy_files(©->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(©->cp_copy.cp_clp->async_lock); if (!list_empty(©->copies)) list_del_init(©->copies); - spin_unlock(©->cp_clp->async_lock); + spin_unlock(©->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1738,14 +1737,14 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, ©->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, ©->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, ©->cp_copy.cp_res, sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, ©->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1758,7 +1757,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1786,8 +1786,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1796,7 +1796,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1822,33 +1822,38 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, memcpy(©->fh, &cstate->current_fh.fh_handle, sizeof(struct knfsd_fh)); if (nfsd4_copy_is_async(copy)) { - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); + /* + * dup after writing cb_stateid; duplicating first would leave + * the callback stateid zeroed. + */ + dup_copy_fields(copy, &async_copy->cp_copy); async_copy->copy_task = kthread_create(nfsd4_do_async_copy, async_copy, "%s", "copy thread"); if (IS_ERR(async_copy->copy_task)) goto out_err; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1873,10 +1878,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1888,10 +1893,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1907,7 +1912,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -1995,13 +2000,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 5140197771ad..0d62c65ae4d4 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..4ac30b2ec7c5 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,29 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, reaper linkage), so its params and result are snapshotted + * into the embedded cp_copy and it never points into the request buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1