In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: release path refs on follow_down() error<\/p>\n
nfsd_cross_mnt() initializes a local struct path with mntget() and
\ndget() before calling follow_down(). On a negative return the error
\narm jumps to out without releasing those references:<\/p>\n
err = follow_down(&path, follow_flags);
\n if (err < 0)
\n goto out;<\/p>\n
follow_down() never drops the caller's entry-time refs on any error
\nsub-case; for example a pre-cross d_manage() failure leaves path
\nuntouched, so the mntget()\/dget() taken on entry survive the call.<\/p>\n
Every other early-exit arm in nfsd_cross_mnt() (other-namespace
\nreturn, IS_ERR(exp2), and the success tail after the swap) already
\ncalls path_put(&path); the err < 0 arm is the lone omission. The
\nleak inflates mnt_count and d_count on each failed cross-mount,
\nblocking umount and pinning dentries against the shrinker, and is
\nreachable by any authenticated NFS client through nfsd_lookup_dentry
\nor the NFSv4 READDIR encode path.<\/p>\n
Fix by calling path_put(&path) before the goto out in the err < 0
\narm so the entry-time refs are released on all follow_down() error
\nreturns.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: release path refs on follow_down() error<\/p>\n
nfsd_cross_mnt() initializes a local struct path with mntget() and
\ndget() before ca<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21629","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}