]> www.infradead.org Git - users/dwmw2/linux.git/commit
NFSD: unregister shrinker when nfsd_init_net() fails
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mon, 10 Oct 2022 05:59:02 +0000 (14:59 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 10 Apr 2024 14:19:20 +0000 (16:19 +0200)
commit15d01caf35878d253fed5365f7be7b20a3836f58
tree18769066db187316e31a2bc7026a0f521015157a
parentd1b0ceeac1dc487310c7f544358361265f71854d
NFSD: unregister shrinker when nfsd_init_net() fails

[ Upstream commit bd86c69dae65de30f6d47249418ba7889809e31a ]

syzbot is reporting UAF read at register_shrinker_prepared() [1], for
commit 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on
low memory condition") missed that nfsd4_leases_net_shutdown() from
nfsd_exit_net() is called only when nfsd_init_net() succeeded.
If nfsd_init_net() fails due to nfsd_reply_cache_init() failure,
register_shrinker() from nfsd4_init_leases_net() has to be undone
before nfsd_init_net() returns.

Link: https://syzkaller.appspot.com/bug?extid=ff796f04613b4c84ad89
Reported-by: syzbot <syzbot+ff796f04613b4c84ad89@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 7746b32f467b3813 ("NFSD: add shrinker to reap courtesy clients on low memory condition")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/nfsctl.c