Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2232253/?format=api
{ "id": 2232253, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2232253/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260504041108.88774-4-matthew.ruffell@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.2/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260504041108.88774-4-matthew.ruffell@canonical.com>", "list_archive_url": null, "date": "2026-05-04T04:10:58", "name": "[SRU,J,3/3] SUNRPC: Do not dereference non-socket transports in sysfs", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "27bee3f152853a967175a2d991a31b8333a87917", "submitter": { "id": 76884, "url": "http://patchwork.ozlabs.org/api/1.2/people/76884/?format=api", "name": "Matthew Ruffell", "email": "matthew.ruffell@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260504041108.88774-4-matthew.ruffell@canonical.com/mbox/", "series": [ { "id": 502608, "url": "http://patchwork.ozlabs.org/api/1.2/series/502608/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=502608", "date": "2026-05-04T04:10:58", "name": "SUNRPC: System wide grep leads to NULL pointer deference in sysfs reads", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502608/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2232253/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2232253/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=j/vGm0/p;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g87WX0tK1z1yJV\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 04 May 2026 14:11:49 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wJkeT-0001Ye-5W; Mon, 04 May 2026 04:11:25 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <matthew.ruffell@canonical.com>)\n id 1wJkeS-0001YN-6E\n for kernel-team@lists.ubuntu.com; Mon, 04 May 2026 04:11:24 +0000", "from mail-pj1-f72.google.com (mail-pj1-f72.google.com\n [209.85.216.72])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 10E873F182\n for <kernel-team@lists.ubuntu.com>; Mon, 4 May 2026 04:11:24 +0000 (UTC)", "by mail-pj1-f72.google.com with SMTP id\n 98e67ed59e1d1-3653638874cso832708a91.2\n for <kernel-team@lists.ubuntu.com>; Sun, 03 May 2026 21:11:23 -0700 (PDT)", "from Garunix (122-58-201-163-adsl.sparkbb.co.nz. [122.58.201.163])\n by smtp.gmail.com with ESMTPSA id\n 98e67ed59e1d1-364ec027690sm9665264a91.13.2026.05.03.21.11.20\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Sun, 03 May 2026 21:11:21 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1777867884;\n bh=iDrU26ehONyeJZ0UkSyO0TAmkNVKx0mUeVvJBcOXfz8=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=j/vGm0/pRBzGcYp7bL34OQcw5TVbN1YnW0AUlSzy/+TDtLESDJXtqDghs8srYM6wy\n d0IGzt9EUQJ8SGVLR3bPse6+aOl9u2Lt0nca6k5bnlBFCSK6XEvSsyjnz+0pZJNjAl\n jPTNZjPEfgQKKUZntKEypCH0kPd5D0tKwT9kBIC7Bf/8K+/hasBNpwBgOg9zLiQ97A\n pPBEUGGqxlYou6TiJWOChGEmaqSjaJRKTsXSaheV5+tABmrnEi/7ynCpRTr0YdHwxt\n COuETSCRltM8bBF6MNoZ2TIzot4vLmudU3ajnyNi81uykMHSPESZ5hNUk5KW2BhmtQ\n GNJt6sTkpdPJ3SZ+Pw73C97XeNPpyAZk3uLMwM/HKMmhkHcbcmuPXUAjUxNlp8iTWw\n oJOmouQCl5A9zhJ5VSZXd3Pi8HtYjTMOh8xBhvZ9epXNb9rxyTvJDL+VI25BoWEpPc\n jESWyh+urxv9swDrMG63LSAX++61v3Fwsvfd8gk1XgQRukJ+UI8q0V9DMCRnz6ZY1q\n UosMH7/Js/lD24Qlt5eACHde0/4q/TWVMJoVXjA3GTuWOnhXaozndE3HT9HU+PYBVK\n TZY5q/Xs0BiGkOBKp7W5F22CYR8Q69sGSV0M6RWRYxgp/ZKZ5R09JYCxtn//kl1o7o\n F7nrDZBc8XeQdrUWXY0qGSGk=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777867883; x=1778472683;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=iDrU26ehONyeJZ0UkSyO0TAmkNVKx0mUeVvJBcOXfz8=;\n b=ppXYFhtgF5HsCd9dEBlGgCiilmxkECqfb3iDWxf6h1Iboo1/56qFV77nTNNad8a8E3\n gOi/9g6uRZuHz20GyVnBKLFamdPz0gxoRDI3I/DOrC16768aK7cJ3u/sUSVLUlhBNjU7\n rFFNd+aKDPLNwf67gYj5ibBdNzx+F47RGjf+KiRcrVDjm/s/6unFiF86SnXknZ4eEPxf\n Sf7nIOzwLnKPZKS0fivafyqhdmr4rEdQ40/cgREtXRE6QoFf3iCnHGD0t69IoAWjkwOc\n zQg0ZTj5PTRiBT1f9uPwo9w1WomcWmduriN7+p6wFr5dLT+8qVnlxPjgYzBHP7hCK31V\n /2uw==", "X-Gm-Message-State": "AOJu0Yz+Q+ffmfIp2wjL8yvNX1d0hqQGEuR0CM6Pq5jDToR/WZHpnBBb\n 8fmqvfmbu7wQyyCfzpI3s+bw8mx4v9tcg+liS4rxDcHdBdEqUmFEGeTFQYPdKGGQiaWlyebw40C\n OOMEAtxcdXtbPIkPs1jvc2rR/Zp0onrxkzZdQ02VaMQo2IqyOn9xdEP58+M1NcJjkWJ9oL31Mt4\n DimK2ouJKPkr9CyA==", "X-Gm-Gg": "AeBDiet71BjkfF8LcEptzuKULzmrjkMCf4QGiKgFL7yC/76B8dU2ujBuxZV5xhhJUWT\n Bce4mXuu6mGTbK0dImZ0COWNK5gFnJNBj6vwFzrTHf71iCsLbhiFA9asjKfTJomuF9wfkzqyu2y\n Ks4vah+l8UskK00g8N7HErljVVcNt9gW61ostfZtG2f2P0XD2khhYw0/lSQYU3/ddCqMNuOiBwq\n c10ONi3I42qVWq9o5P9diT2iQbrrfNHllk0k6wOr1kDViK28QNPtYl9M0p+uJpwACQhRWjeJA7m\n rNdXRZtWEWsIqt3TMZJvCrHuE+c5x5OE9xerPxCF/yPzpV2pNaWGtF0N6ZiDNWAqB6tOVB+9Pwl\n KAYSSfxXNZlniX8hvsdo/Qowhyx0OUX/pUFu8OmiRDiMHpHzP4Yb0Sh/VVa87hLiuxbUpM6xsk+\n JR", "X-Received": [ "by 2002:a17:90a:ec86:b0:35f:bd29:75b9 with SMTP id\n 98e67ed59e1d1-3650cee7ca6mr7973905a91.22.1777867882680;\n Sun, 03 May 2026 21:11:22 -0700 (PDT)", "by 2002:a17:90a:ec86:b0:35f:bd29:75b9 with SMTP id\n 98e67ed59e1d1-3650cee7ca6mr7973881a91.22.1777867882270;\n Sun, 03 May 2026 21:11:22 -0700 (PDT)" ], "From": "Matthew Ruffell <matthew.ruffell@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J][PATCH 3/3] SUNRPC: Do not dereference non-socket transports\n in sysfs", "Date": "Mon, 4 May 2026 16:10:58 +1200", "Message-ID": "<20260504041108.88774-4-matthew.ruffell@canonical.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260504041108.88774-1-matthew.ruffell@canonical.com>", "References": "<20260504041108.88774-1-matthew.ruffell@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Trond Myklebust <trond.myklebust@hammerspace.com>\n\nBugLink: https://bugs.launchpad.net/bugs/2149767\n\nDo not cast the struct xprt to a sock_xprt unless we know it is a UDP or\nTCP transport. Otherwise the call to lock the mutex will scribble over\nwhatever structure is actually there. This has been seen to cause hard\nsystem lockups when the underlying transport was RDMA.\n\nFixes: b49ea673e119 (\"SUNRPC: lock against ->sock changing during sysfs read\")\nCc: stable@vger.kernel.org\nSigned-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>\n(cherry picked from commit 421ab1be43bd015ffe744f4ea25df4f19d1ce6fe)\nSigned-off-by: Matthew Ruffell <matthew.ruffell@canonical.com>\n---\n include/linux/sunrpc/xprt.h | 3 ++\n include/linux/sunrpc/xprtsock.h | 1 -\n net/sunrpc/sysfs.c | 55 ++++++++++++++++-----------------\n net/sunrpc/xprtsock.c | 26 ++++++++++++++--\n 4 files changed, 54 insertions(+), 31 deletions(-)", "diff": "diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h\nindex 955ea4d7af0b..eef5e87c03b4 100644\n--- a/include/linux/sunrpc/xprt.h\n+++ b/include/linux/sunrpc/xprt.h\n@@ -139,6 +139,9 @@ struct rpc_xprt_ops {\n \tvoid\t\t(*rpcbind)(struct rpc_task *task);\n \tvoid\t\t(*set_port)(struct rpc_xprt *xprt, unsigned short port);\n \tvoid\t\t(*connect)(struct rpc_xprt *xprt, struct rpc_task *task);\n+\tint\t\t(*get_srcaddr)(struct rpc_xprt *xprt, char *buf,\n+\t\t\t\t size_t buflen);\n+\tunsigned short\t(*get_srcport)(struct rpc_xprt *xprt);\n \tint\t\t(*buf_alloc)(struct rpc_task *task);\n \tvoid\t\t(*buf_free)(struct rpc_task *task);\n \tvoid\t\t(*prepare_request)(struct rpc_rqst *req);\ndiff --git a/include/linux/sunrpc/xprtsock.h b/include/linux/sunrpc/xprtsock.h\nindex 3eb0079669c5..38284f25eddf 100644\n--- a/include/linux/sunrpc/xprtsock.h\n+++ b/include/linux/sunrpc/xprtsock.h\n@@ -10,7 +10,6 @@\n \n int\t\tinit_socket_xprt(void);\n void\t\tcleanup_socket_xprt(void);\n-unsigned short\tget_srcport(struct rpc_xprt *);\n \n #define RPC_MIN_RESVPORT\t(1U)\n #define RPC_MAX_RESVPORT\t(65535U)\ndiff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c\nindex 33e8fb85ce4f..e643dd8748a2 100644\n--- a/net/sunrpc/sysfs.c\n+++ b/net/sunrpc/sysfs.c\n@@ -97,7 +97,7 @@ static ssize_t rpc_sysfs_xprt_dstaddr_show(struct kobject *kobj,\n \t\treturn 0;\n \tret = sprintf(buf, \"%s\\n\", xprt->address_strings[RPC_DISPLAY_ADDR]);\n \txprt_put(xprt);\n-\treturn ret + 1;\n+\treturn ret;\n }\n \n static ssize_t rpc_sysfs_xprt_srcaddr_show(struct kobject *kobj,\n@@ -105,33 +105,31 @@ static ssize_t rpc_sysfs_xprt_srcaddr_show(struct kobject *kobj,\n \t\t\t\t\t char *buf)\n {\n \tstruct rpc_xprt *xprt = rpc_sysfs_xprt_kobj_get_xprt(kobj);\n-\tstruct sockaddr_storage saddr;\n-\tstruct sock_xprt *sock;\n-\tssize_t ret = -1;\n+\tsize_t buflen = PAGE_SIZE;\n+\tssize_t ret = -ENOTSOCK;\n \n \tif (!xprt || !xprt_connected(xprt)) {\n-\t\txprt_put(xprt);\n-\t\treturn -ENOTCONN;\n+\t\tret = -ENOTCONN;\n+\t} else if (xprt->ops->get_srcaddr) {\n+\t\tret = xprt->ops->get_srcaddr(xprt, buf, buflen);\n+\t\tif (ret > 0) {\n+\t\t\tif (ret < buflen - 1) {\n+\t\t\t\tbuf[ret] = '\\n';\n+\t\t\t\tret++;\n+\t\t\t\tbuf[ret] = '\\0';\n+\t\t\t}\n+\t\t}\n \t}\n-\n-\tsock = container_of(xprt, struct sock_xprt, xprt);\n-\tmutex_lock(&sock->recv_mutex);\n-\tif (sock->sock == NULL ||\n-\t kernel_getsockname(sock->sock, (struct sockaddr *)&saddr) < 0)\n-\t\tgoto out;\n-\n-\tret = sprintf(buf, \"%pISc\\n\", &saddr);\n-out:\n-\tmutex_unlock(&sock->recv_mutex);\n \txprt_put(xprt);\n-\treturn ret + 1;\n+\treturn ret;\n }\n \n static ssize_t rpc_sysfs_xprt_info_show(struct kobject *kobj,\n-\t\t\t\t\tstruct kobj_attribute *attr,\n-\t\t\t\t\tchar *buf)\n+\t\t\t\t\tstruct kobj_attribute *attr, char *buf)\n {\n \tstruct rpc_xprt *xprt = rpc_sysfs_xprt_kobj_get_xprt(kobj);\n+\tunsigned short srcport = 0;\n+\tsize_t buflen = PAGE_SIZE;\n \tssize_t ret;\n \n \tif (!xprt || !xprt_connected(xprt)) {\n@@ -139,7 +137,11 @@ static ssize_t rpc_sysfs_xprt_info_show(struct kobject *kobj,\n \t\treturn -ENOTCONN;\n \t}\n \n-\tret = sprintf(buf, \"last_used=%lu\\ncur_cong=%lu\\ncong_win=%lu\\n\"\n+\tif (xprt->ops->get_srcport)\n+\t\tsrcport = xprt->ops->get_srcport(xprt);\n+\n+\tret = snprintf(buf, buflen,\n+\t\t \"last_used=%lu\\ncur_cong=%lu\\ncong_win=%lu\\n\"\n \t\t \"max_num_slots=%u\\nmin_num_slots=%u\\nnum_reqs=%u\\n\"\n \t\t \"binding_q_len=%u\\nsending_q_len=%u\\npending_q_len=%u\\n\"\n \t\t \"backlog_q_len=%u\\nmain_xprt=%d\\nsrc_port=%u\\n\"\n@@ -147,14 +149,11 @@ static ssize_t rpc_sysfs_xprt_info_show(struct kobject *kobj,\n \t\t xprt->last_used, xprt->cong, xprt->cwnd, xprt->max_reqs,\n \t\t xprt->min_reqs, xprt->num_reqs, xprt->binding.qlen,\n \t\t xprt->sending.qlen, xprt->pending.qlen,\n-\t\t xprt->backlog.qlen, xprt->main,\n-\t\t (xprt->xprt_class->ident == XPRT_TRANSPORT_TCP) ?\n-\t\t get_srcport(xprt) : 0,\n+\t\t xprt->backlog.qlen, xprt->main, srcport,\n \t\t atomic_long_read(&xprt->queuelen),\n-\t\t (xprt->xprt_class->ident == XPRT_TRANSPORT_TCP) ?\n-\t\t\t\txprt->address_strings[RPC_DISPLAY_PORT] : \"0\");\n+\t\t xprt->address_strings[RPC_DISPLAY_PORT]);\n \txprt_put(xprt);\n-\treturn ret + 1;\n+\treturn ret;\n }\n \n static ssize_t rpc_sysfs_xprt_state_show(struct kobject *kobj,\n@@ -201,7 +200,7 @@ static ssize_t rpc_sysfs_xprt_state_show(struct kobject *kobj,\n \t}\n \n \txprt_put(xprt);\n-\treturn ret + 1;\n+\treturn ret;\n }\n \n static ssize_t rpc_sysfs_xprt_switch_info_show(struct kobject *kobj,\n@@ -220,7 +219,7 @@ static ssize_t rpc_sysfs_xprt_switch_info_show(struct kobject *kobj,\n \t\t xprt_switch->xps_nunique_destaddr_xprts,\n \t\t atomic_long_read(&xprt_switch->xps_queuelen));\n \txprt_switch_put(xprt_switch);\n-\treturn ret + 1;\n+\treturn ret;\n }\n \n static ssize_t rpc_sysfs_xprt_dstaddr_store(struct kobject *kobj,\ndiff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c\nindex e8baecec6d1d..eac9811a280c 100644\n--- a/net/sunrpc/xprtsock.c\n+++ b/net/sunrpc/xprtsock.c\n@@ -1677,7 +1677,7 @@ static int xs_get_srcport(struct sock_xprt *transport)\n \treturn port;\n }\n \n-unsigned short get_srcport(struct rpc_xprt *xprt)\n+static unsigned short xs_sock_srcport(struct rpc_xprt *xprt)\n {\n \tstruct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);\n \tunsigned short ret = 0;\n@@ -1687,7 +1687,25 @@ unsigned short get_srcport(struct rpc_xprt *xprt)\n \tmutex_unlock(&sock->recv_mutex);\n \treturn ret;\n }\n-EXPORT_SYMBOL(get_srcport);\n+\n+static int xs_sock_srcaddr(struct rpc_xprt *xprt, char *buf, size_t buflen)\n+{\n+\tstruct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);\n+\tunion {\n+\t\tstruct sockaddr sa;\n+\t\tstruct sockaddr_storage st;\n+\t} saddr;\n+\tint ret = -ENOTCONN;\n+\n+\tmutex_lock(&sock->recv_mutex);\n+\tif (sock->sock) {\n+\t\tret = kernel_getsockname(sock->sock, &saddr.sa);\n+\t\tif (ret >= 0)\n+\t\t\tret = snprintf(buf, buflen, \"%pISc\", &saddr.sa);\n+\t}\n+\tmutex_unlock(&sock->recv_mutex);\n+\treturn ret;\n+}\n \n static unsigned short xs_next_srcport(struct sock_xprt *transport, unsigned short port)\n {\n@@ -2693,6 +2711,8 @@ static const struct rpc_xprt_ops xs_udp_ops = {\n \t.rpcbind\t\t= rpcb_getport_async,\n \t.set_port\t\t= xs_set_port,\n \t.connect\t\t= xs_connect,\n+\t.get_srcaddr\t\t= xs_sock_srcaddr,\n+\t.get_srcport\t\t= xs_sock_srcport,\n \t.buf_alloc\t\t= rpc_malloc,\n \t.buf_free\t\t= rpc_free,\n \t.send_request\t\t= xs_udp_send_request,\n@@ -2715,6 +2735,8 @@ static const struct rpc_xprt_ops xs_tcp_ops = {\n \t.rpcbind\t\t= rpcb_getport_async,\n \t.set_port\t\t= xs_set_port,\n \t.connect\t\t= xs_connect,\n+\t.get_srcaddr\t\t= xs_sock_srcaddr,\n+\t.get_srcport\t\t= xs_sock_srcport,\n \t.buf_alloc\t\t= rpc_malloc,\n \t.buf_free\t\t= rpc_free,\n \t.prepare_request\t= xs_stream_prepare_request,\n", "prefixes": [ "SRU", "J", "3/3" ] }