In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path<\/p>\n
When the server returns a new layout stateid while a valid one is still
\nheld, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
\nthe on-stack free_me list and jumps to out_forget. Segments whose
\nreference count drops to zero are unlinked from lo->plh_segs and moved
\nto free_me by mark_lseg_invalid(); for an idle cached segment the layout
\nheader holds the only reference, so this happens on the first decrement.<\/p>\n
out_forget never drains free_me — only the success path calls
\npnfs_free_lseg_list().<\/p>\n
Commit 814b84971388 (“pNFS\/NFSv4: Fix a layout segment leak in
\npnfs_layout_process()”) added the drain; commit 08bd8dbe8882
\n(“pNFS\/NFSv4: Try to return invalid layout in pnfs_layout_process()”)
\nremoved it while switching the destination to lo->plh_return_segs, which
\nis drained elsewhere. Commit fb700ef02676 (“NFSv4.1: Simplify layout
\nreturn in pnfs_layout_process()”) switched the destination back to
\nfree_me without restoring the drain.<\/p>\n
Restore the pnfs_free_lseg_list() call.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path<\/p>\n
When the server returns a new layout stateid while a val<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21632","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21632","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21632"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21632"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21632"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}