]> git.itanic.dy.fi Git - linux-stable/commit
NFSD: unregister shrinker when nfsd_init_net() fails
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mon, 10 Oct 2022 05:59:02 +0000 (14:59 +0900)
committerChuck Lever <chuck.lever@oracle.com>
Tue, 11 Oct 2022 14:08:26 +0000 (10:08 -0400)
commitbd86c69dae65de30f6d47249418ba7889809e31a
tree8bc8039109fb10eb154db10f6280c481bbd843dd
parent243a5263014a30436c93ed3f1f864c1da845455e
NFSD: unregister shrinker when nfsd_init_net() fails

syzbot is reporting UAF read at register_shrinker_prepared() [1], for
commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on
low memory condition") missed that nfsd4_leases_net_shutdown() from
nfsd_exit_net() is called only when nfsd_init_net() succeeded.
If nfsd_init_net() fails due to nfsd_reply_cache_init() failure,
register_shrinker() from nfsd4_init_leases_net() has to be undone
before nfsd_init_net() returns.

Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89
Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/nfsctl.c