From 8ca3b74c0c447af17d0e27e76658a3d4cae3c5ba Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 16:31:54 +0000 Subject: [PATCH] nfsd: Fix id-to-name cache entry leak in idtoname_parse() idtoname_lookup() returns the id-to-name cache entry with a new reference. The name is parsed between the lookup and the update call, and when the parsed name is malformed (negative length or longer than IDMAP_NAMESZ), idtoname_parse() jumps to the error label without dropping the reference returned by idtoname_lookup(), leaking the cache entry. Release the reference with cache_put() before taking the error exit. Fixes: f9ecc921b5b5 ("[PATCH] knfsd: Use new cache code for name/id lookup caches") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Jeff Layton Link: https://patch.msgid.link/20260917163154.2162438-1-vulab@iscas.ac.cn Signed-off-by: Chuck Lever --- fs/nfsd/nfs4idmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c index 4e5297593963..059345c7d119 100644 --- a/fs/nfsd/nfs4idmap.c +++ b/fs/nfsd/nfs4idmap.c @@ -254,8 +254,10 @@ idtoname_parse(struct cache_detail *cd, char *buf, int buflen) /* Name */ error = -EINVAL; len = qword_get(&buf, buf1, PAGE_SIZE); - if (len < 0 || len >= IDMAP_NAMESZ) + if (len < 0 || len >= IDMAP_NAMESZ) { + cache_put(&res->h, cd); goto out; + } if (len == 0) set_bit(CACHE_NEGATIVE, &ent.h.flags); else