In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFS\/localio: fix ref leak on nfs_uuid_add_file failure<\/p>\n
When nfs_uuid_add_file() races with nfs_uuid_put() tearing down
\nuuid->net, it returns -ENXIO without publishing nfl->nfs_uuid via
\nrcu_assign_pointer(). nfs_open_local_fh() then enters its error
\nbranch and only releases the slot’s file ref and its paired net
\nref plus its own entry-time net ref, while the close path is a
\nno-op:<\/p>\n
nfs_close_local_fh()
\n nfs_uuid = rcu_dereference(nfl->nfs_uuid);
\n if (!nfs_uuid) { rcu_read_unlock(); return; } \/* always *\/<\/p>\n
nfsd_open_local_fh() returns localio holding a caller-owned +1
\nnfsd_file reference (from nfsd_file_get() after
\nnfsd_file_acquire_local()) and an entry-time nfsd_net reference
\n(from its first nfsd_net_try_get()) embedded as nf->nf_net. Both
\nare leaked on the failure path, pinning one nfsd_file (and the
\nunderlying struct file, dentry, inode) and one nfsd_net_ref per
\noccurrence, which blocks nfsd_net and netns teardown.<\/p>\n
Fix by releasing the caller-owned file ref and its net ref through
\nthe existing helper, using a stack-local RCU pointer so the helper
\ncan xchg it out, then returning -ENXIO so callers do not
\ndereference a localio whose slot has been cleared:<\/p>\n
struct nfsd_file __rcu *tmp = RCU_INITIALIZER(localio);<\/p>\n
nfs_to_nfsd_file_put_local(pnf);
\n nfs_to_nfsd_file_put_local(&tmp);
\n localio = ERR_PTR(-ENXIO);<\/p>\n
The trailing nfs_to_nfsd_net_put(net) continues to release the
\nouter net ref, so all three nfsd_net_try_get() increments are
\nbalanced on the error branch.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFS\/localio: fix ref leak on nfs_uuid_add_file failure<\/p>\n
When nfs_uuid_add_file() races with nfs_uuid_put() tearing down
\nuuid->net, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21637","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}