diff options
authorRick Macklem <rmacklem@FreeBSD.org>2020-09-24 14:59:10 +0000
committerRick Macklem <rmacklem@FreeBSD.org>2020-09-24 14:59:10 +0000
commit7006fb18e65da308132e8ddabbee59cb10fe920c (patch)
parent97f844cd60ddb0b56fa4ed0977620fd0cd7e15b0 (diff)
MFS: r365703
Fix a case where the NFSv4.0 server might crash if delegations are enabled. asomers@ reported a crash on an NFSv4.0 server with a backtrace of: kdb_backtrace vpanic panic nfsrv_docallback nfsrv_checkgetattr nfsrvd_getattr nfsrvd_dorpc nfssvc_program svc_run_internal svc_thread_start fork_exit fork_trampoline where the panic message was "docallb", which indicates that a callback was attempted when the ClientID is unconfirmed. This would not normally occur, but it is possible to have an unconfirmed ClientID structure with delegation structure(s) chained off it if the client were to issue a SetClientID with the same "id" but different "verifier" after acquiring delegations on the previously confirmed ClientID. The bug appears to be that nfsrv_checkgetattr() failed to check for this uncommon case of an unconfirmed ClientID with a delegation structure that no longer refers to a delegation the client knows about. This patch adds a check for this case, handling it as if no delegation exists, which is the case when the above occurs. Although difficult to reproduce, this change should avoid the panic(). PR: 249127 Approved by: re (gjb)
Notes: svn path=/releng/12.2/; revision=366116
1 files changed, 7 insertions, 1 deletions
diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c
index c53312b748ca..f57a84752890 100644
--- a/sys/fs/nfsserver/nfs_nfsdstate.c
+++ b/sys/fs/nfsserver/nfs_nfsdstate.c
@@ -5692,8 +5692,14 @@ nfsrv_checkgetattr(struct nfsrv_descript *nd, vnode_t vp,
goto out;
clp = stp->ls_clp;
- delegfilerev = stp->ls_filerev;
+ /* If the clientid is not confirmed, ignore the delegation. */
+ if (clp->lc_flags & LCL_NEEDSCONFIRM) {
+ goto out;
+ }
+ delegfilerev = stp->ls_filerev;
* If the Write delegation was issued as a part of this Compound RPC
* or if we have an Implied Clientid (used in a previous Op in this