Description
In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < e3c413f789eaf0170275c7eba523ead73d963f30affected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < 08a455f87b14c7ff22ae3fdadda62a796a3a5572affected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < 550c19222c7132c888e23c9d89079ba1c9bc4ccaaffected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < 350087f231c11efcd288c310707c40eab63ca583affected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < c24bdb7df2f34bdc38ca8a73796f5acb40f1830caffected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < 41f0a6d31615fcae261bf28a0aa50050dc93a401affected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < e999a88133654c6dfc68487fb49da5f20dfa2d4faffected01df9c5e918ae5559f2d96da0143f8bfbb9e6171 to < 526c49cff3f72c3ec74752016380c7567040581baffected
Linux Linux
Default version status: affected
2.6.18affected0 to < 2.6.18unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30 ↗
- https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572 ↗
- https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca ↗
- https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583 ↗
- https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c ↗
- https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401 ↗
- https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f ↗
- https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b ↗