diff options
| author | Jeff Layton <jlayton@kernel.org> | 2026-05-22 10:36:14 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:44:21 +0200 |
| commit | 017a6150106b054cc84d1b0582d97bd3a74d4281 (patch) | |
| tree | f9774fa81b271ea41f049c1fb4f074fed8a17126 | |
| parent | 0f28337f54cfb7f9777bbc2018be52b7c76c620e (diff) | |
| download | linux-stable-017a6150106b054cc84d1b0582d97bd3a74d4281.tar.gz linux-stable-017a6150106b054cc84d1b0582d97bd3a74d4281.zip | |
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
commit 57aee7a35bb12753057c5b65d72d1f46c0e95b07 upstream.
When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it
calls release_openowner() and sets oo = NULL. Control then falls through
past the `if (oo)` guard -- which would have freed any pre-allocated
`new` -- and unconditionally executes `new = alloc_stateowner(...)`. If
`new` was already allocated on a prior iteration, the pointer is
silently overwritten and the previous allocation (slab object + owner
name buffer) is leaked.
This requires a race: two NFSv4.0 OPEN threads with the same owner
string, where a concurrent thread inserts a new unconfirmed owner into
the hash between retry iterations. The window is narrow but repeatable
under adversarial conditions.
Fix by adding `goto retry` after `oo = NULL` so the already-allocated
`new` is reused on the next iteration rather than overwritten.
Reported-by: Chris Mason <clm@meta.com>
Fixes: 23df17788c62 ("nfsd: perform all find_openstateowner_str calls in the one place.")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/nfsd/nfs4state.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index a9e95df2fdb6..b02fe9926b09 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -5176,6 +5176,7 @@ retry: /* Replace unconfirmed owners without checking for replay. */ release_openowner(oo); oo = NULL; + goto retry; } if (oo) { if (new) |