tree f276c784d350286631e6c8130466f689a2331537
parent 991aebcefd2f21cd1f8062ec0c9e6db80603bd17
author Xingyuan Mo <hdthky0@gmail.com> 1673454293 +0800
committer Anil Altinay <aaltinay@google.com> 1681259473 +0000

NFSD: fix use-after-free in nfsd4_ssc_setup_dul()

[ Upstream commit e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd ]

If signal_pending() returns true, schedule_timeout() will not be executed,
causing the waiting task to remain in the wait queue.
Fixed by adding a call to finish_wait(), which ensures that the waiting
task will always be removed from the wait queue.

BUG=b/277429063
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2023-1652.

Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Change-Id: Ic8b30a9e8d02fae871db9bdb957daa6920fe8548
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46527
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Meena Shanmugam <meenashanmugam@google.com>