Patchwork [hardy] NLM: Don't hang forever on NLM unlock requests - CVE-2011-2491

login
register
mail settings
Submitter Paolo Pisati
Date Oct. 12, 2011, 2:32 p.m.
Message ID <1318429938-16867-2-git-send-email-paolo.pisati@canonical.com>
Download mbox | patch
Permalink /patch/119218/
State New
Headers show

Comments

Paolo Pisati - Oct. 12, 2011, 2:32 p.m.
From: Trond Myklebust <Trond.Myklebust@netapp.com>

NLM: Don't hang forever on NLM unlock requests

If the NLM daemon is killed on the NFS server, we can currently end up
hanging forever on an 'unlock' request, instead of aborting. Basically,
if the rpcbind request fails, or the server keeps returning garbage, we
really want to quit instead of retrying.

Tested-by: Vasily Averin <vvs@sw.ru>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@kernel.org

CVE-2011-2491

BugLink: http://bugs.launchpad.net/bugs/869237

commit upstream 0b760113a3a155269a3fba93a409c640031dd68f

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
---
 fs/lockd/clntproc.c          |    8 +++++++-
 include/linux/sunrpc/sched.h |    1 +
 net/sunrpc/clnt.c            |    3 +++
 net/sunrpc/sched.c           |    1 +
 4 files changed, 12 insertions(+), 1 deletions(-)

Patch

diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index a10343b..e288810 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -655,7 +655,13 @@  static void nlmclnt_unlock_callback(struct rpc_task *task, void *data)
 
 	if (task->tk_status < 0) {
 		dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
-		goto retry_rebind;
+		switch (task->tk_status) {
+		case -EACCES:
+		case -EIO:
+			goto die;
+		default:
+			goto retry_rebind;
+		}
 	}
 	if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
 		rpc_delay(task, NLMCLNT_GRACE_WAIT);
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 8ea077d..1ab5a60 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -55,6 +55,7 @@  struct rpc_task {
 	struct rpc_message	tk_msg;		/* RPC call info */
 	__u8			tk_garb_retry;
 	__u8			tk_cred_retry;
+	__u8			tk_rebind_retry;
 
 	unsigned long		tk_cookie;	/* Cookie for batching tasks */
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 76be83e..31b5956 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -964,6 +964,9 @@  call_bind_status(struct rpc_task *task)
 			status = -EOPNOTSUPP;
 			break;
 		}
+		if (task->tk_rebind_retry == 0)
+			break;
+		task->tk_rebind_retry--;
 		rpc_delay(task, 3*HZ);
 		goto retry_timeout;
 	case -ETIMEDOUT:
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index c98873f..9e243a6 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -826,6 +826,7 @@  void rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt, int flags, cons
 	/* Initialize retry counters */
 	task->tk_garb_retry = 2;
 	task->tk_cred_retry = 2;
+	task->tk_rebind_retry = 2;
 
 	task->tk_priority = RPC_PRIORITY_NORMAL;
 	task->tk_cookie = (unsigned long)current;