Josef Bacik
6cd3f13aaa
nfs: fix UAF in direct writes ...
commit 17f46b803d4f23c66cacce81db35fef3adb8f2af upstream.
In production we have been hitting the following warning consistently
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0
Workqueue: nfsiod nfs_direct_write_schedule_work [nfs]
RIP: 0010:refcount_warn_saturate+0x9c/0xe0
PKRU: 55555554
Call Trace:
<TASK>
? __warn+0x9f/0x130
? refcount_warn_saturate+0x9c/0xe0
? report_bug+0xcc/0x150
? handle_bug+0x3d/0x70
? exc_invalid_op+0x16/0x40
? asm_exc_invalid_op+0x16/0x20
? refcount_warn_saturate+0x9c/0xe0
nfs_direct_write_schedule_work+0x237/0x250 [nfs]
process_one_work+0x12f/0x4a0
worker_thread+0x14e/0x3b0
? ZSTD_getCParams_internal+0x220/0x220
kthread+0xdc/0x120
? __btf_name_valid+0xa0/0xa0
ret_from_fork+0x1f/0x30
This is because we're completing the nfs_direct_request twice in a row.
The source of this is when we have our commit requests to submit, we
process them and send them off, and then in the completion path for the
commit requests we have
if (nfs_commit_end(cinfo.mds))
nfs_direct_write_complete(dreq);
However since we're submitting asynchronous requests we sometimes have
one that completes before we submit the next one, so we end up calling
complete on the nfs_direct_request twice.
The only other place we use nfs_generic_commit_list() is in
__nfs_commit_inode, which wraps this call in a
nfs_commit_begin();
nfs_commit_end();
Which is a common pattern for this style of completion handling, one
that is also repeated in the direct code with get_dreq()/put_dreq()
calls around where we process events as well as in the completion paths.
Fix this by using the same pattern for the commit requests.
Before with my 200 node rocksdb stress running this warning would pop
every 10ish minutes. With my patch the stress test has been running for
several hours without popping.
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
[ chanho : Backports v5.4.y, commit 133a48abf6ec (NFS: Fix up commit deadlocks)
is needed to use nfs_commit_end ]
Signed-off-by: Chanho Min <chanho.min@lge.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:37 +02:00
firmware: meson_sm: Rework driver as a proper platform driver
2024-04-13 12:51:26 +02:00
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-06-04 14:32:33 +02:00
RDMA/mlx5: Enforce same type port association for multiport RoCE
2025-01-09 13:23:34 +01:00
mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
2023-12-13 18:18:15 +01:00
mtd: rawnand: protect access to rawnand devices while in suspend
2024-11-17 14:58:51 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
2024-08-19 05:33:42 +02:00
qed: Improve the stack space of filter_config()
2024-08-19 05:33:30 +02:00
regulator: gpio: Add input_supply support in gpio_regulator_config
2025-07-17 18:24:58 +02:00
sched/smt: Always inline sched_smt_active()
2025-04-10 14:29:42 +02:00
firmware: ti_sci: Replace HTTP links with HTTPS ones
2023-11-20 10:30:12 +01:00
spi: Fix deadlock when adding SPI controllers on SPI buses
2024-11-17 14:58:51 +01:00
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
2024-12-14 19:44:42 +01:00
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
2025-08-28 16:21:33 +02:00
ACPI/IORT: Make iort_msi_map_rid() PCI agnostic
2023-12-13 18:18:10 +01:00
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
2025-06-27 11:02:56 +01:00
writeback: fix false warning in inode_to_wb()
2025-05-02 07:39:19 +02:00
coredump: hand a pidfd to the usermode coredump helper
2025-06-04 14:32:36 +02:00
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
2024-09-04 13:14:50 +02:00
block: return unsigned int from bdev_io_min
2024-12-14 19:44:41 +01:00
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
2024-02-23 08:24:57 +01:00
cgroup: Move rcu_head up near the top of cgroup_root
2024-12-14 19:44:35 +01:00
clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
2023-08-30 16:27:27 +02:00
ftruncate: pass a signed offset
2024-07-05 09:08:31 +02:00
Fix gcc 4.9 build issue in 5.4.y
2024-08-19 05:33:53 +02:00
init: Provide arch_cpu_finalize_init()
2023-08-08 19:56:33 +02:00
hrtimers: Push pending hrtimers away from outgoing CPU earlier
2023-12-13 18:18:09 +01:00
bitmap: introduce generic optimized bitmap_size()
2024-09-04 13:14:50 +02:00
cred: switch to using atomic_long_t
2023-12-20 15:41:18 +01:00
dm mpath: pass IO start time to path selector
2024-09-04 13:14:58 +02:00
driver: platform: Add helper for safer setting of driver_override
2023-11-08 11:23:39 +01:00
dma-mapping: avoid potential unused data compilation warning
2025-06-04 14:32:29 +02:00
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
2024-02-23 08:25:06 +01:00
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
2024-12-14 19:44:55 +01:00
ethernet: Add helper for assigning packet type when dest address does not match device address
2024-05-02 16:18:36 +02:00
eventfd: Export eventfd_ctx_do_read()
2023-09-23 10:59:40 +02:00
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
2024-03-26 18:22:15 -04:00
objtool: Add support for intra-function calls
2024-04-13 12:51:29 +02:00
mm: drop the assumption that VM_SHARED always implies writable
2025-08-28 16:21:36 +02:00
fsnotify: Do not generate events for O_PATH file descriptors
2024-07-18 11:40:51 +02:00
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
2024-04-13 12:51:34 +02:00
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
2025-06-27 11:02:56 +01:00
gpu: host1x: mipi: Update tegra_mipi_request() to be node based
2024-03-26 18:22:18 -04:00
hrtimers: Handle CPU state correctly on hotplug
2025-02-01 18:18:51 +01:00
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
2025-01-09 13:23:33 +01:00
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
2024-09-12 11:03:50 +02:00
clockevents/drivers/i8253: Fix stop sequence for timer 0
2025-04-10 14:29:34 +02:00
Fix termination state for idr_for_each_entry_ul()
2023-11-20 10:30:15 +01:00
net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
2023-09-23 10:59:55 +02:00
team: fix null-ptr-deref when team device type is changed
2023-10-10 21:46:37 +02:00
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
2025-08-28 16:21:27 +02:00
interconnect: Add helpers for enabling/disabling a path
2023-08-30 16:27:13 +02:00
lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
2025-04-10 14:29:40 +02:00
iommu: Return right value in iommu_sva_bind_device()
2024-07-05 09:08:16 +02:00
resource: Add irqresource_disabled()
2023-10-25 11:53:22 +02:00
genirq: Allow irq_chip registration functions to take a const irq_chip
2024-08-19 05:33:45 +02:00
genirq: Allow the PM device to originate from irq domain
2024-08-19 05:33:43 +02:00
jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
2024-11-08 16:20:30 +01:00
time: Fix references to _msecs_to_jiffies() handling of values
2024-12-14 19:44:23 +01:00
module: Extend the preempt disabled section in dereference_symbol_descriptor().
2025-03-13 12:42:59 +01:00
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
2025-03-13 12:43:07 +01:00
leds: class: Protect brightness_show() with led_cdev->led_access mutex
2024-12-14 19:44:53 +01:00
ata: libata-sata: increase PMP SRST timeout to 10s
2023-10-10 21:46:42 +02:00
list: add "list_del_init_careful()" to go with "list_empty_careful()"
2023-06-28 10:18:35 +02:00
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
2024-03-01 13:13:38 +01:00
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
mcb: remove is_added flag from mcb_device struct
2023-10-25 11:53:19 +02:00
net: phy: mchp: Add support for LAN8814 QUAD PHY
2024-07-05 09:08:27 +02:00
mm: update memfd seal write check to include F_SEAL_WRITE
2025-08-28 16:21:36 +02:00
mm: fix ambiguous comments for better code readability
2024-11-17 14:58:53 +01:00
module: Restore the moduleparam prefix length check
2025-08-28 16:21:21 +02:00
new helper: lookup_positive_unlocked()
2023-09-23 10:59:40 +02:00
net: add dev_net_rcu() helper
2025-03-13 12:43:17 +01:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
netpoll: netpoll_send_skb() returns transmit status
2025-04-10 14:29:35 +02:00
nfs: add missing selections of CONFIG_CRC32
2025-05-02 07:39:20 +02:00
nfs: fix UAF in direct writes
2025-08-28 16:21:37 +02:00
fs/nls: make load_nls() take a const parameter
2023-09-23 10:59:38 +02:00
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
2023-07-27 08:37:10 +02:00
nvme: fixup comment for nvme RDMA Provider Type
2024-07-05 09:08:28 +02:00
mlxsw: spectrum_acl_erp: Fix object nesting warning
2024-08-19 05:33:28 +02:00
of: Add of_property_present() helper
2025-07-17 18:24:52 +02:00
of/irq: Make of_msi_map_rid() PCI bus agnostic
2023-12-13 18:18:11 +01:00
overflow: Allow mixed type arguments
2025-03-13 12:42:52 +01:00
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
2025-08-28 16:21:33 +02:00
can: ems_pci: move ASIX AX99100 ids to pci_ids.h
2025-03-13 12:43:18 +01:00
perf/core: Add a new read format to get a number of lost samples
2023-12-13 18:18:15 +01:00
pid: add pidfd_prepare()
2025-06-04 14:32:36 +02:00
driver: platform: Add helper for safer setting of driver_override
2023-11-08 11:23:39 +01:00
PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
2024-02-23 08:25:14 +01:00
PM / wakeirq: support enabling wake-up irq after runtime_suspend called
2023-08-11 11:54:00 +02:00
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
2025-02-01 18:18:51 +01:00
pps: fix poll support
2025-08-28 16:21:18 +02:00
sched/rt: Provide migrate_disable/enable() inlines
2023-11-20 10:30:12 +01:00
pwm: Fix double shift bug
2023-11-28 16:50:16 +00:00
quota: Fix slow quotaoff
2023-10-25 11:53:18 +02:00
quota: Fix slow quotaoff
2023-10-25 11:53:18 +02:00
scsi: core: raid_class: Remove raid_component_add()
2023-08-30 16:27:27 +02:00
rcu: add a helper to report consolidated flavor QS
2024-03-26 18:22:25 -04:00
rcu: fix header guard for rcu_all_qs()
2025-06-04 14:32:34 +02:00
regmap: Add bulk read/write callbacks into regmap_config
2024-03-15 10:48:20 -04:00
ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance()
2024-09-12 11:03:56 +02:00
rpmsg: Fix calling device_lock() on non-initialized device
2023-11-08 11:23:39 +01:00
lsm: new security_file_ioctl_compat() hook
2024-02-23 08:25:15 +01:00
Revert "8250: add support for ASIX devices with a FIFO bug"
2023-07-27 08:37:38 +02:00
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
2024-05-02 16:18:37 +02:00
netmem: fix skb_frag_address_safe with unreadable skbs
2025-08-28 16:21:27 +02:00
ftruncate: pass a signed offset
2024-07-05 09:08:31 +02:00
tcp: add TCP_INFO status for failed client TFO
2024-07-18 11:40:53 +02:00
timers: Rename del_timer_sync() to timer_delete_sync()
2024-04-13 12:51:21 +02:00
tracing: Constify string literal data member in struct trace_event_call
2025-01-09 13:23:33 +01:00
types: Complement the aligned types with signed 64-bit one
2025-06-04 14:32:27 +02:00
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
2024-05-02 16:18:28 +02:00
units: add the HZ macros
2024-02-23 08:24:47 +01:00
xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
2025-02-01 18:18:54 +01:00
util_macros.h: fix/rework find_closest() macros
2024-12-14 19:44:43 +01:00
vfio: Introduce interface to flush virqfd inject workqueue
2024-04-13 12:51:34 +02:00
net: do not allow gso_size to be set to GSO_BY_FRAGS
2023-08-30 16:27:17 +02:00
epoll: Add synchronous wakeup support for ep_poll_callback
2025-01-09 13:23:32 +01:00
workqueue: clean up WORK_* constant types, clarify masking
2023-07-27 08:37:29 +02:00
