diff options
| author | Jeff Layton <jlayton@kernel.org> | 2026-07-10 10:00:09 -0400 |
|---|---|---|
| committer | Chuck Lever <cel@kernel.org> | 2026-08-10 09:54:35 -0400 |
| commit | 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf (patch) | |
| tree | 2e7d14f768e07a1b939c77745c713d1ffa27c43c | |
| parent | 129643893b79f8a3c6b72045f933fbab5ee424ca (diff) | |
| download | linux-6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf.tar.gz linux-6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf.zip | |
nfsd: check client ownership when cancelling a copy-notify stateid
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.
Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-5-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
| -rw-r--r-- | fs/nfsd/nfs4state.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 528365b89a35..ad72c0d57bee 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -8010,10 +8010,20 @@ __be32 manage_cpntf_state(struct nfsd_net *nn, stateid_t *st, state = NULL; goto unlock; } - if (!clp) + if (!clp) { refcount_inc(&state->cp_stateid.cs_count); - else + } else if (memcmp(&clp->cl_clientid, &state->cp_p_clid, + sizeof(clientid_t))) { + /* + * OFFLOAD_CANCEL: only the creating client may cancel. + * so_id is guessable, so without this check any client + * could free another's cpntf state. + */ + state = NULL; + goto unlock; + } else { _free_cpntf_state_locked(nn, state); + } } unlock: spin_unlock(&nn->s2s_cp_lock); |