This is a note to let you know that I've just added the patch titled
NFSv4/pnfs: Fix a use-after-free bug in open
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nfsv4-pnfs-fix-a-use-after-free-bug-in-open.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Date: Tue, 2 Aug 2022 15:48:50 -0400
Subject: NFSv4/pnfs: Fix a use-after-free bug in open
From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
commit 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac upstream.
If someone cancels the open RPC call, then we must not try to free
either the open slot or the layoutget operation arguments, since they
are likely still in use by the hung RPC call.
Fixes: 6949493884fe ("NFSv4: Don't hold the layoutget locks across multiple RPC calls")
Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/nfs/nfs4proc.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3106,12 +3106,13 @@ static int _nfs4_open_and_get_state(stru
}
out:
- if (opendata->lgp) {
- nfs4_lgopen_release(opendata->lgp);
- opendata->lgp = NULL;
- }
- if (!opendata->cancelled)
+ if (!opendata->cancelled) {
+ if (opendata->lgp) {
+ nfs4_lgopen_release(opendata->lgp);
+ opendata->lgp = NULL;
+ }
nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+ }
return ret;
}
Patches currently in stable-queue which might be from trond.myklebust@xxxxxxxxxxxxxxx are
queue-5.15/nfsv4-pnfs-fix-a-use-after-free-bug-in-open.patch
queue-5.15/nfsv4.1-handle-nfs4err_delay-replies-to-op_sequence-correctly.patch
queue-5.15/nfsv4.1-don-t-decrease-the-value-of-seq_nr_highest_sent.patch
queue-5.15/nfsv4.1-reclaim_complete-must-handle-eacces.patch
queue-5.15/sunrpc-reinitialise-the-backchannel-request-buffers-before-reuse.patch
queue-5.15/sunrpc-fix-expiry-of-auth-creds.patch
queue-5.15/nfsv4-fix-races-in-the-legacy-idmapper-upcall.patch
