Description
In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e580323ac0b51ad10ec2e181d1f777479b7983e7 to < bca74fff138429f3d5802865f38fc883d53a4f1aaffected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < d7c677feb3aa1f42b1026d75a8ea61338b51e4fbaffected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < 39f59bf67231ed2eb0cdf6337194360e964b609aaffected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < ddfbd816273b4e9c9b836f5b8773664c6f40f807affected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < 1403f1221a35a6caf959bb7bf005741f17263c66affected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < 1161c4b5bd0048c8148e919f818a33cff3623ef0affected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < 3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9affected7f024fcd5c97dc70bb9121c80407cf3cf9be7159 to < f16a1513452edb532fec81e591c64c320866719caffected5.10.220 to < 5.10.261affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/bca74fff138429f3d5802865f38fc883d53a4f1a ↗
- https://git.kernel.org/stable/c/d7c677feb3aa1f42b1026d75a8ea61338b51e4fb ↗
- https://git.kernel.org/stable/c/39f59bf67231ed2eb0cdf6337194360e964b609a ↗
- https://git.kernel.org/stable/c/ddfbd816273b4e9c9b836f5b8773664c6f40f807 ↗
- https://git.kernel.org/stable/c/1403f1221a35a6caf959bb7bf005741f17263c66 ↗
- https://git.kernel.org/stable/c/1161c4b5bd0048c8148e919f818a33cff3623ef0 ↗
- https://git.kernel.org/stable/c/3f2dc01b9cb516d4727a3b9263ee58c71ca00ba9 ↗
- https://git.kernel.org/stable/c/f16a1513452edb532fec81e591c64c320866719c ↗