linux-stable.git/net/sunrpc, branch linux-5.2.y

SUNRPC: Fix buffer handling of GSS MIC without slack

2019-10-05T11:14:14+00:00

commit 5f1bc39979d868a0358c683864bec3fc8395440b upstream.

The GSS Message Integrity Check data for krb5i may lie partially in the XDR
reply buffer's pages and tail.  If so, we try to copy the entire MIC into
free space in the tail.  But as the estimations of the slack space required
for authentication and verification have improved there may be less free
space in the tail to complete this copy -- see commit 2c94b8eca1a2
("SUNRPC: Use au_rslack when computing reply buffer size").  In fact, there
may only be room in the tail for a single copy of the MIC, and not part of
the MIC and then another complete copy.

The real world failure reported is that `ls` of a directory on NFS may
sometimes return -EIO, which can be traced back to xdr_buf_read_netobj()
failing to find available free space in the tail to copy the MIC.

Fix this by checking for the case of the MIC crossing the boundaries of
head, pages, and tail. If so, shift the buffer until the MIC is contained
completely within the pages or tail.  This allows the remainder of the
function to create a sub buffer that directly address the complete MIC.

Signed-off-by: Benjamin Coddington 
Cc: stable@vger.kernel.org # v5.1
Reviewed-by: Chuck Lever 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Dequeue the request from the receive queue while we're re-encoding

2019-10-05T11:14:14+00:00

commit cc204d01262a69218b2d0db5cdea371de85871d9 upstream.

Ensure that we dequeue the request from the transport receive queue
while we're re-encoding to prevent issues like use-after-free when
we release the bvec.

Fixes: 7536908982047 ("SUNRPC: Ensure the bvecs are reset when we re-encode...")
Signed-off-by: Trond Myklebust 
Cc: stable@vger.kernel.org # v4.20+
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Handle connection breakages correctly in call_status()

2019-09-21T05:18:03+00:00

commit c82e5472c9980e0e483f4b689044150eefaca408 upstream.

If the connection breaks while we're waiting for a reply from the
server, then we want to immediately try to reconnect.

Fixes: ec6017d90359 ("SUNRPC fix regression in umount of a secure mount")
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Don't handle errors if the bind/connect succeeded

2019-09-06T08:23:47+00:00

commit bd736ed3e2d1088d9b4050f727342e1e619c3841 upstream.

Don't handle errors in call_bind_status()/call_connect_status()
if it turns out that a previous call caused it to succeed.

Signed-off-by: Trond Myklebust 
Cc: stable@vger.kernel.org # v5.1+
Signed-off-by: Greg Kroah-Hartman

Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was invalidated"

2019-09-06T08:23:45+00:00

commit d5711920ec6e578f51db95caa6f185f5090b865e upstream.

This reverts commit a79f194aa4879e9baad118c3f8bb2ca24dbef765.
The mechanism for aborting I/O is racy, since we are not guaranteed that
the request is asleep while we're changing both task->tk_status and
task->tk_action.

Signed-off-by: Trond Myklebust 
Cc: stable@vger.kernel.org # v5.1
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request

2019-07-26T07:10:55+00:00

commit 75369089820473eac45e9ddd970081901a373c08 upstream.

The bvec tracks the list of pages, so if the number of pages changes
due to a re-encode, we need to reset the bvec as well.

Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching...")
Signed-off-by: Trond Myklebust 
Cc: stable@vger.kernel.org # v4.20+
Signed-off-by: Greg Kroah-Hartman

Merge tag 'nfsd-5.2-2' of git://linux-nfs.org/~bfields/linux

2019-07-06T02:00:37+00:00

Pull nfsd fixes from Bruce Fields:
 "Two more quick bugfixes for nfsd: fixing a regression causing mount
  failures on high-memory machines and fixing the DRC over RDMA"

* tag 'nfsd-5.2-2' of git://linux-nfs.org/~bfields/linux:
  nfsd: Fix overflow causing non-working mounts on 1 TB machines
  svcrdma: Ignore source port when computing DRC hash

SUNRPC: Fix up calculation of client message length

2019-06-28T15:17:47+00:00

In the case where a record marker was used, xs_sendpages() needs
to return the length of the payload + record marker so that we
operate correctly in the case of a partial transmission.
When the callers check return value, they therefore need to
take into account the record marker length.

Fixes: 06b5fc3ad94e ("Merge tag 'nfs-rdma-for-5.1-1'...")
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Trond Myklebust 
Signed-off-by: Anna Schumaker

SUNRPC: Fix a credential refcount leak

2019-06-21T18:45:09+00:00

All callers of __rpc_clone_client() pass in a value for args->cred,
meaning that the credential gets assigned and referenced in
the call to rpc_new_client().

Reported-by: Ido Schimmel 
Fixes: 79caa5fad47c ("SUNRPC: Cache cred of process creating the rpc_client")
Signed-off-by: Trond Myklebust 
Tested-by: Ido Schimmel 
Signed-off-by: Anna Schumaker

Revert "SUNRPC: Declare RPC timers as TIMER_DEFERRABLE"

2019-06-21T18:43:42+00:00

Jon Hunter reports:
  "I have been noticing intermittent failures with a system suspend test on
   some of our machines that have a NFS mounted root file-system. Bisecting
   this issue points to your commit 431235818bc3 ("SUNRPC: Declare RPC
   timers as TIMER_DEFERRABLE") and reverting this on top of v5.2-rc3 does
   appear to resolve the problem.

   The cause of the suspend failure appears to be a long delay observed
   sometimes when resuming from suspend, and this is causing our test to
   timeout."

This reverts commit 431235818bc3a919ca7487500c67c3144feece80.

Reported-by: Jon Hunter 
Signed-off-by: Anna Schumaker