From 7b811c9a757c0dc3401924d2e264c1390bb1398a Mon Sep 17 00:00:00 2001 From: Scott Mayhew Date: Wed, 3 Nov 2021 06:24:40 -0400 Subject: [PATCH 1/2] nfs4: take a reference on the nfs_client when running FREE_STATEID ANBZ: #44382 commit 576acc259146af848cec0940f573f7125a116b9f upstream. commit d0009f95625df1bf1b8e96b2eb9f48bfbfdbec4f stable. During umount, the session slot tables are freed. If there are outstanding FREE_STATEID tasks, a use-after-free and slab corruption can occur when rpc_exit_task calls rpc_call_done -> nfs41_sequence_done -> nfs4_sequence_process/nfs41_sequence_free_slot. Prevent that from happening by taking a reference on the nfs_client in nfs41_free_stateid and putting it in nfs41_free_stateid_release. Signed-off-by: Scott Mayhew Signed-off-by: Trond Myklebust Stable-dep-of: cf616096a0f3 ("NFS: Pin the 'struct nfs_server' during a FREE_STATEID call") Signed-off-by: Sasha Levin Fixes: CVE-2026-74730 Assisted-by: PatchPilot Signed-off-by: Joseph Qi --- fs/nfs/nfs4proc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index cc5cad447b9b..39fc6e866289 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10116,6 +10116,10 @@ static void nfs41_free_stateid_done(struct rpc_task *task, void *calldata) static void nfs41_free_stateid_release(void *calldata) { + struct nfs_free_stateid_data *data = calldata; + struct nfs_client *clp = data->server->nfs_client; + + nfs_put_client(clp); kfree(calldata); } @@ -10152,6 +10156,10 @@ static int nfs41_free_stateid(struct nfs_server *server, }; struct nfs_free_stateid_data *data; struct rpc_task *task; + struct nfs_client *clp = server->nfs_client; + + if (!refcount_inc_not_zero(&clp->cl_count)) + return -EIO; nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_STATEID, &task_setup.rpc_client, &msg); -- Gitee From bb095a1e42c4c65d5809109a4b57f723a16cc1b5 Mon Sep 17 00:00:00 2001 From: Anna Schumaker Date: Tue, 30 Jun 2026 14:31:00 -0400 Subject: [PATCH 2/2] NFS: Pin the 'struct nfs_server' during a FREE_STATEID call ANBZ: #44382 commit cf616096a0f3a2b60f7d68b6b39674a6867ded9c upstream. commit ed2f92ce2fc48463c41e0e540b9a3454889e8af8 stable. Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight. Reported-by: Dan Aloni Fixes: 7c1d5fae4a87 ("NFSv4: Convert nfs41_free_stateid to use an asynchronous RPC call") Tested-by: Dan Aloni Signed-off-by: Anna Schumaker Signed-off-by: Sasha Levin Fixes: CVE-2026-74730 Assisted-by: PatchPilot Signed-off-by: Joseph Qi --- fs/nfs/nfs4proc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 39fc6e866289..d36c23a18f7b 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10119,6 +10119,7 @@ static void nfs41_free_stateid_release(void *calldata) struct nfs_free_stateid_data *data = calldata; struct nfs_client *clp = data->server->nfs_client; + nfs_sb_deactive(data->server->super); nfs_put_client(clp); kfree(calldata); } @@ -10160,6 +10161,10 @@ static int nfs41_free_stateid(struct nfs_server *server, if (!refcount_inc_not_zero(&clp->cl_count)) return -EIO; + if (!nfs_sb_active(server->super)) { + nfs_put_client(clp); + return -EIO; + } nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_STATEID, &task_setup.rpc_client, &msg); -- Gitee