In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: revoke copy-notify stateids before dropping their reference<\/p>\n
Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent
\nstid’s sc_cp_list, pinned by a single membership reference.
\n_free_cpntf_state_locked() only unlinks an entry once its refcount reaches
\nzero, so any revoke path that runs while a concurrent
\nfind_cpntf_state()\/manage_cpntf_state() holder has elevated cs_count drops
\nthe reference without unlinking, leaving the entry discoverable with its
\nmembership reference already consumed. A second revoke or a laundromat tick
\nthen frees it while the reader still holds the pointer — a
\nKASAN-detectable use-after-free at the reader’s nfs4_put_cpntf_state().<\/p>\n
This affected all three revoke paths:<\/p>\n
– The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called
\n _free_cpntf_state_locked() on the first list entry; a holder that had
\n bumped cs_count made it return early, so the next iteration
\n re-decremented and burned the holder’s reference.<\/p>\n
– OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise
\n used _free_cpntf_state_locked() and could drop 2->1 without unlinking.<\/p>\n
Add revoke_cpntf_state_locked(), which unhashes the entry from the IDR and
\nsc_cp_list first (deferring the final free to any holder), and use it from
\nall three revoke paths. The drain now walks with list_for_each_entry_safe()
\nand revokes each entry unconditionally, so it terminates in one pass per
\nentry regardless of cs_count. The unhash is gated on
\n!list_empty(&cps->cp_list); the idr_remove() gate matters because
\nidr_alloc_cyclic() may have recycled the so_id by then. Keep
\n_free_cpntf_state_locked() for the reference-holder put path only, where a
\nconcurrent revoke may already have unlinked the entry (its list_del_init()
\nthen a no-op).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: revoke copy-notify stateids before dropping their reference<\/p>\n
Copy-notify stateids live in the s2s_cp_stateids IDR and on thei<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21585","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21585","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}