github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfsd: check client ownership when cancelling a copy-notify stateid

Browse Source 
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.

Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.

Fixes: ce0887ac96 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-5-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
This commit is contained in:
Jeff Layton 2026-07-10 10:00:09 -04:00 committed by Chuck Lever
parent 129643893b
commit 6bdbfab96e
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/nfsd/nfs4state.c
View File

@ -8010,10 +8010,20 @@ __be32 manage_cpntf_state(struct nfsd_net *nn, stateid_t *st,
state = NULL;
goto unlock;
}
if (!clp)
if (!clp) {
refcount_inc(&state->cp_stateid.cs_count);
else
} else if (memcmp(&clp->cl_clientid, &state->cp_p_clid,
sizeof(clientid_t))) {
/*
* OFFLOAD_CANCEL: only the creating client may cancel.
* so_id is guessable, so without this check any client
* could free another's cpntf state.
*/
state = NULL;
goto unlock;
} else {
_free_cpntf_state_locked(nn, state);
}
}
unlock:
spin_unlock(&nn->s2s_cp_lock);