github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfsd-7.2 fixes:

Browse Source 
Issues reported with v7.2-rc:
 - Fix a UAF when unlocking a filesystem
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmpUTYQACgkQM2qzM29m
 f5fluA//Ttq+/8JVZnAwxCYyMTM+ix8S1qYAP9eXxB4OwHVjVGdm/aAHbm6fmnuw
 IiMdJw0ZB2RQEFrD+jLJxWipYil/oHYUhUsS1sxSLTE9RMeAVnD4SbGEO1Hg2imV
 zISIpM7kNkh7NcJkKgzb8mCh04C6TSLwUsq36sOf6H6JlWJsQjM9j6t343pET3NY
 IDxjCIz/C7wfPRHsg+ycsXCvbrF3tE27Grq2HX0/0tPIo8JoqR3sCgIWz00UN3NT
 QE0FfPU0fUmn0TW6WupMmibC/cSBjUkEayEIWOuRdo2HfjdHFJKKVEJhbPfueHZU
 NiTTyMaIC2bKXclAZR9CEggyZmdfJTBMkmQSIvMKr2XWYKcLFTrVfcXpU3iuYgLq
 R97keupMX5YrBA1HZa+pWozuBdBxYD4ykJFFYy3hF+84X8JY4om3g40mtIG1P52/
 lc61qZGqMGddkPPL7pGVxJ0l6husKeCd3T/vo1HupeRg1swOB0VzCYK9NNo1tBO4
 yf7ZdqOE2r7crmYpIE2woNdXs9fGpkpZriLq8iWvlVWIuHHfjYolk0a62QIO/GV1
 Tgvu442+gJYcf+QLOZIf+YRA1LvNxXyENR/ZKXDhQ85h/nTEULKL5Ne9Fqq2qOTk
 5YCNE6/XkB5sGNA/aF06RPDnUjuBNX7PTEMt5a+t2ikB5nkq/YY=
 =NRRN
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

Pull nfsd fix from Chuck Lever:

 - Fix a use-after-free when unlocking a filesystem

* tag 'nfsd-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  NFSD: Prevent post-shutdown use-after-free in NFSD_CMD_UNLOCK_FILESYSTEM
This commit is contained in:
Linus Torvalds 2026-07-13 08:38:01 -07:00
commit 0f26556c5e
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/nfsd/nfsctl.c
View File

@ -2340,14 +2340,15 @@ int nfsd_nl_unlock_filesystem_doit(struct sk_buff *skb,
if (error)
return error;
nfsd4_cancel_copy_by_sb(net, path.dentry->d_sb);
error = nlmsvc_unlock_all_by_sb(path.dentry->d_sb);
mutex_lock(&nfsd_mutex);
if (nn->nfsd_serv)
if (nn->nfsd_serv) {
nfsd4_cancel_copy_by_sb(net, path.dentry->d_sb);
nfsd4_revoke_states(nn, path.dentry->d_sb);
else
} else {
error = -EINVAL;
}
mutex_unlock(&nfsd_mutex);
path_put(&path);