hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICM78G CVE: NA -------------------------------- LOCK may extend an existing lock and release another one and UNLOCK may also release an existing lock. When opening a file, there may be access to file locks that have been concurrently released by lock/unlock operations, potentially triggering UAF. While certain concurrent scenarios involving lock/unlock and open operations have been safeguarded with locks – for example, nfs4_proc_unlckz() acquires the so_delegreturn_mutex prior to invoking locks_lock_inode_wait() – there remain cases where such protection is not yet implemented. The issue can be reproduced through the following steps: T1: open in read-only mode with three consecutive lock operations applied lock1(0~100) --> add lock1 to file lock2(120~200) --> add lock2 to file lock3(50~150) --> extend lock1 to cover range 0~200 and release lock2 T2: restart nfs-server and run state manager T3: open in write-only mode T1 T2 T3 start recover lock1 lock2 nfs4_open_reclaim clear_bit // NFS_DELEGATED_STATE lock3 _nfs4_proc_setlk lock so_delegreturn_mutex unlock so_delegreturn_mutex _nfs4_do_setlk recover done lock so_delegreturn_mutex nfs_delegation_claim_locks get lock2 rpc_run_task ... nfs4_lock_done locks_lock_inode_wait ... locks_dispose_list free lock2 use lock2 // UAF unlock so_delegreturn_mutex Protect file lock by nfsi->rwsem to fix this issue. Fixes: c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update") Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> --- fs/nfs/delegation.c | 3 +++ fs/nfs/nfs4proc.c | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c index 98811a077450..2ed9edf9f7ed 100644 --- a/fs/nfs/delegation.c +++ b/fs/nfs/delegation.c @@ -106,6 +106,7 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags) static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid) { struct inode *inode = state->inode; + struct nfs_inode *nfsi = NFS_I(inode); struct file_lock *fl; struct file_lock_context *flctx = inode->i_flctx; struct list_head *list; @@ -115,6 +116,7 @@ static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_state goto out; list = &flctx->flc_posix; + down_write(&nfsi->rwsem); spin_lock(&flctx->flc_lock); restart: list_for_each_entry(fl, list, fl_list) { @@ -132,6 +134,7 @@ static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_state } spin_unlock(&flctx->flc_lock); out: + up_write(&nfsi->rwsem); return status; } diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 6d47a1922a1b..29cb861ae449 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6603,12 +6603,16 @@ static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock * status = -ENOMEM; if (IS_ERR(seqid)) goto out; + down_read(&nfsi->rwsem); task = nfs4_do_unlck(request, nfs_file_open_context(request->fl_file), lsp, seqid); status = PTR_ERR(task); - if (IS_ERR(task)) + if (IS_ERR(task)) { + up_read(&nfsi->rwsem); goto out; + } status = rpc_wait_for_completion_task(task); rpc_put_task(task); + up_read(&nfsi->rwsem); out: request->fl_flags = fl_flags; trace_nfs4_unlock(request, state, F_SETLK, status); @@ -6945,7 +6949,9 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock } up_read(&nfsi->rwsem); mutex_unlock(&sp->so_delegreturn_mutex); + down_read(&nfsi->rwsem); status = _nfs4_do_setlk(state, cmd, request, NFS_LOCK_NEW); + up_read(&nfsi->rwsem); out: request->fl_flags = fl_flags; return status; -- 2.31.1