Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph. Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist. Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d63528eb0d43c4796c42aad56889dec12cf4e122 to < 4e8b69c06bd6583ec11abef4fae50c2c8d5f3679affectedd63528eb0d43c4796c42aad56889dec12cf4e122 to < d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04affectedd63528eb0d43c4796c42aad56889dec12cf4e122 to < d31db79cfaa9fce6649772ad279779473ba8aef9affectedd63528eb0d43c4796c42aad56889dec12cf4e122 to < f77d2accafca529e0ea3f979eb6e6cf1dac05c90affectedd63528eb0d43c4796c42aad56889dec12cf4e122 to < 514a0b2bc949963497e66cacd433f65dc768a71daffectedd63528eb0d43c4796c42aad56889dec12cf4e122 to < 215e8816b1ac25176d911abb8704390413ccee4baffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4e8b69c06bd6583ec11abef4fae50c2c8d5f3679 ↗
- https://git.kernel.org/stable/c/d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04 ↗
- https://git.kernel.org/stable/c/d31db79cfaa9fce6649772ad279779473ba8aef9 ↗
- https://git.kernel.org/stable/c/f77d2accafca529e0ea3f979eb6e6cf1dac05c90 ↗
- https://git.kernel.org/stable/c/514a0b2bc949963497e66cacd433f65dc768a71d ↗
- https://git.kernel.org/stable/c/215e8816b1ac25176d911abb8704390413ccee4b ↗