Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 26 Jun 2021 23:42:05 GMT
From:      Rick Macklem <rmacklem@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 6ae32cc8182f - stable/12 - krpc: Acquire ref count of CLIENT for backchannel use
Message-ID:  <202106262342.15QNg52Z020452@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=6ae32cc8182f4a48f0606f4b561a98010e1946b8

commit 6ae32cc8182f4a48f0606f4b561a98010e1946b8
Author:     Rick Macklem <rmacklem@FreeBSD.org>
AuthorDate: 2021-06-11 23:57:14 +0000
Commit:     Rick Macklem <rmacklem@FreeBSD.org>
CommitDate: 2021-06-26 23:36:37 +0000

    krpc: Acquire ref count of CLIENT for backchannel use
    
    Michael Dexter <editor@callfortesting.org> reported
    a crash in FreeNAS, where the first argument to
    clnt_bck_svccall() was no longer valid.
    This argument is a pointer to the callback CLIENT
    structure, which is free'd when the associated
    NFSv4 ClientID is free'd.
    
    This appears to have occurred because a callback
    reply was still in the socket receive queue when
    the CLIENT structure was free'd.
    
    This patch acquires a reference count on the CLIENT
    that is not CLNT_RELEASE()'d until the socket structure
    is destroyed. This should guarantee that the CLIENT
    structure is still valid when clnt_bck_svccall() is called.
    It also adds a check for closed or closing to
    clnt_bck_svccall() so that it will not process the callback
    RPC reply message after the ClientID is free'd.
    
    (cherry picked from commit e1a907a25cfa422c0d1acaf9f91352ada04f4bca)
---
 sys/fs/nfsserver/nfs_nfsdstate.c |  8 ++++----
 sys/rpc/clnt_bck.c               | 13 ++++++++++++-
 sys/rpc/svc.h                    |  5 +++++
 sys/rpc/svc_vc.c                 |  4 ++++
 4 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c
index abd4099a7ee2..3423eddc7366 100644
--- a/sys/fs/nfsserver/nfs_nfsdstate.c
+++ b/sys/fs/nfsserver/nfs_nfsdstate.c
@@ -722,8 +722,8 @@ nfsrv_getclient(nfsquad_t clientid, int opflags, struct nfsclient **clpp,
 				    cbprogram, NFSV4_CBVERS);
 			    if (clp->lc_req.nr_client != NULL) {
 				SVC_ACQUIRE(nd->nd_xprt);
-				nd->nd_xprt->xp_p2 =
-				    clp->lc_req.nr_client->cl_private;
+				CLNT_ACQUIRE(clp->lc_req.nr_client);
+				nd->nd_xprt->xp_p2 = clp->lc_req.nr_client;
 				/* Disable idle timeout. */
 				nd->nd_xprt->xp_idletimeout = 0;
 				nsep->sess_cbsess.nfsess_xprt = nd->nd_xprt;
@@ -6440,8 +6440,8 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t *sessionid, int *foreaftp)
 				    "backchannel\n");
 				savxprt = sep->sess_cbsess.nfsess_xprt;
 				SVC_ACQUIRE(nd->nd_xprt);
-				nd->nd_xprt->xp_p2 =
-				    clp->lc_req.nr_client->cl_private;
+				CLNT_ACQUIRE(clp->lc_req.nr_client);
+				nd->nd_xprt->xp_p2 = clp->lc_req.nr_client;
 				/* Disable idle timeout. */
 				nd->nd_xprt->xp_idletimeout = 0;
 				sep->sess_cbsess.nfsess_xprt = nd->nd_xprt;
diff --git a/sys/rpc/clnt_bck.c b/sys/rpc/clnt_bck.c
index 66f3c308e8e1..7e4a28f229e5 100644
--- a/sys/rpc/clnt_bck.c
+++ b/sys/rpc/clnt_bck.c
@@ -546,15 +546,26 @@ clnt_bck_destroy(CLIENT *cl)
 /*
  * This call is done by the svc code when a backchannel RPC reply is
  * received.
+ * For the server end, where callback RPCs to the client are performed,
+ * xp_p2 points to the "CLIENT" and not the associated "struct ct_data"
+ * so that svc_vc_destroy() can CLNT_RELEASE() the reference count on it.
  */
 void
 clnt_bck_svccall(void *arg, struct mbuf *mrep, uint32_t xid)
 {
-	struct ct_data *ct = (struct ct_data *)arg;
+	CLIENT *cl = (CLIENT *)arg;
+	struct ct_data *ct;
 	struct ct_request *cr;
 	int foundreq;
 
+	ct = (struct ct_data *)cl->cl_private;
 	mtx_lock(&ct->ct_lock);
+	if (ct->ct_closing || ct->ct_closed) {
+		mtx_unlock(&ct->ct_lock);
+		m_freem(mrep);
+		return;
+	}
+
 	ct->ct_upcallrefs++;
 	/*
 	 * See if we can match this reply to a request.
diff --git a/sys/rpc/svc.h b/sys/rpc/svc.h
index b60b85ef0f53..f5e3fcad3ff1 100644
--- a/sys/rpc/svc.h
+++ b/sys/rpc/svc.h
@@ -148,6 +148,11 @@ struct __rpc_svcthread;
  * reference count which tracks the number of currently assigned
  * worker threads plus one for the service pool's reference.
  * For NFSv4.1 sessions, a reference is also held for a backchannel.
+ * xp_p2 - Points to the CLIENT structure for the RPC server end
+ *         (the client end for callbacks).
+ *         Points to the private structure (cl_private) for the
+ *         CLIENT structure for the RPC client end (the server
+ *         end for callbacks).
  */
 typedef struct __rpc_svcxprt {
 #ifdef _KERNEL
diff --git a/sys/rpc/svc_vc.c b/sys/rpc/svc_vc.c
index dd6b801f44be..f1546615d2df 100644
--- a/sys/rpc/svc_vc.c
+++ b/sys/rpc/svc_vc.c
@@ -474,6 +474,7 @@ static void
 svc_vc_destroy(SVCXPRT *xprt)
 {
 	struct cf_conn *cd = (struct cf_conn *)xprt->xp_p1;
+	CLIENT *cl = (CLIENT *)xprt->xp_p2;
 
 	SOCKBUF_LOCK(&xprt->xp_socket->so_rcv);
 	if (xprt->xp_upcallset) {
@@ -482,6 +483,9 @@ svc_vc_destroy(SVCXPRT *xprt)
 	}
 	SOCKBUF_UNLOCK(&xprt->xp_socket->so_rcv);
 
+	if (cl != NULL)
+		CLNT_RELEASE(cl);
+
 	svc_vc_destroy_common(xprt);
 
 	if (cd->mreq)



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202106262342.15QNg52Z020452>