From patchwork Tue Feb 18 15:44:06 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "J. Bruce Fields" X-Patchwork-Id: 3672991 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C2DA4BF13A for ; Tue, 18 Feb 2014 15:44:16 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id C0807201CD for ; Tue, 18 Feb 2014 15:44:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9FFF320211 for ; Tue, 18 Feb 2014 15:44:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756027AbaBRPoN (ORCPT ); Tue, 18 Feb 2014 10:44:13 -0500 Received: from fieldses.org ([174.143.236.118]:40236 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756026AbaBRPoM (ORCPT ); Tue, 18 Feb 2014 10:44:12 -0500 Received: from bfields by fieldses.org with local (Exim 4.76) (envelope-from ) id 1WFmq6-0001HK-7H; Tue, 18 Feb 2014 10:44:06 -0500 Date: Tue, 18 Feb 2014 10:44:06 -0500 From: "J. Bruce Fields" To: Stanislav Kinsbursky Cc: Weng Meiling , greg@kroah.com, linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, devel@openvz.org Subject: Re: [PATCH] nfsd: check passed socket's net matches NFSd superblock's one Message-ID: <20140218154406.GD4319@fieldses.org> References: <20131230142339.16166.28243.stgit@localhost.localdomain> <20140103222226.GD5164@fieldses.org> <52FEC818.7030604@huawei.com> <20140217221900.GA8401@fieldses.org> <53037A03.4020603@parallels.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <53037A03.4020603@parallels.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Tue, Feb 18, 2014 at 07:19:31PM +0400, Stanislav Kinsbursky wrote: > 18.02.2014 02:19, J. Bruce Fields ?????: > >On Sat, Feb 15, 2014 at 09:51:20AM +0800, Weng Meiling wrote: > >>Hi Bruce, > >> > >>The upstream has merged your git tree for-3.14, but there is no this patch? > >>Do you forget this patch? > > > >Apologies, I'm not sure what happened. > > > >Looking back at it.... The patch causes all my pynfs reboot recovery > >tests to fail. They're just doing a "systemctl restart > >nfs-server.service", and "systemctl status nfs-server.service" shows in > >part > > > > ExecStart=/usr/sbin/rpc.nfsd $RPCNFSDARGS $RPCNFSDCOUNT (code=exited, status=1/FAILURE) > > > >So the patch is causing rpc.nfsd to fail? No network namespaces should > >be involved. > > > >I haven't investigated any further. > > > > Hi Bruce, > Are you sure, that exactly this patch broke your pynfs tests? > BTW, systemd manipulates namespaces. Maybe the patch revealed some pynfs internal bugs? > What do you think? It's really just "systemctl restart nfs-server.service" that the patch breaks, pynfs isn't involved much. The patch I'm actually using follows, but I believe the only difference is in the printk message? --b commit e1f2922c12cb59baba0f2c7726bee992a0861310 Author: Stanislav Kinsbursky Date: Mon Dec 30 17:23:59 2013 +0300 nfsd: check passed socket's net matches the NFSd superblock's The file descriptor written to the nfsd/portlist file could be for a socket in a different network namespace from the network namespace that the nfsd filesystem was mounted in, and this can cause a crash. For example: "ip netns exec" creates a new network and mount namespace, which duplicates the nfsd mount point which was created in the init_net context. Thus NFS server stop in the nested network context leads to RPCBIND client destruction in init_net. Then, on nfsd start in the nested network context, the rpc.nfsd process creates a socket in the nested net and passes it into "write_ports", which leads to RPCBIND socket creation in init_net context for the same reason (the nfsd mount point was created in the init_net context). An attempt to register passed socket in nested net leads to panic, because no RPCBIND client is present in the nested network namespace. This patch adds a check that the passed the socket's net matches the nfsd superblock's net, and returns -EINVAL error to user space if not. Reported-by: Weng Meiling Signed-off-by: Stanislav Kinsbursky Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields --- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 7f55517..1331766 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -699,6 +699,11 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net) if (err != 0 || fd < 0) return -EINVAL; + if (svc_alien_sock(net, fd)) { + printk(KERN_ERR "%s: socket net is different from NFSd's\n", __func__); + return -EINVAL; + } + err = nfsd_create_serv(net); if (err != 0) return err; diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h index 62fd1b7..947009e 100644 --- a/include/linux/sunrpc/svcsock.h +++ b/include/linux/sunrpc/svcsock.h @@ -56,6 +56,7 @@ int svc_recv(struct svc_rqst *, long); int svc_send(struct svc_rqst *); void svc_drop(struct svc_rqst *); void svc_sock_update_bufs(struct svc_serv *serv); +bool svc_alien_sock(struct net *net, int fd); int svc_addsock(struct svc_serv *serv, const int fd, char *name_return, const size_t len); void svc_init_xprt_sock(void); diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index b6e59f0..3ba5b87 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1397,6 +1397,17 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv, return svsk; } +bool svc_alien_sock(struct net *net, int fd) +{ + int err; + struct socket *sock = sockfd_lookup(fd, &err); + + if (sock && (sock_net(sock->sk) != net)) + return true; + return false; +} +EXPORT_SYMBOL_GPL(svc_alien_sock); + /** * svc_addsock - add a listener socket to an RPC service * @serv: pointer to RPC service to which to add a new listener