qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: NFS/NFSD CVE fixes for RHEL 9.9

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8658

Fixes for various NFS/NFSD CVEs:

- nfsd: release layout stid on setlease failure
- NFSv4/flexfiles: reject zero filehandle version count
- nfsd: fix posix_acl leak on SETACL decode failure
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- pNFS: Fix use-after-free in pnfs_update_layout()

JIRA: https://issues.redhat.com/browse/RHEL-225523
JIRA: https://redhat.atlassian.net/browse/RHEL-226326
JIRA: https://redhat.atlassian.net/browse/RHEL-227787
JIRA: https://redhat.atlassian.net/browse/RHEL-228034
JIRA: https://redhat.atlassian.net/browse/RHEL-229413
JIRA: https://redhat.atlassian.net/browse/RHEL-234058

CVE: CVE-2026-53391
CVE: CVE-2026-53392
CVE: CVE-2026-53397
CVE: CVE-2026-53399
CVE: CVE-2026-63800
CVE: CVE-2026-64298

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
Signed-off-by: Scott Mayhew <smayhew@redhat.com>

Approved-by: Roberto Bergantinos Corpas <rbergant@redhat.com>
Approved-by: Olga Kornievskaia <okorniev@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-31 17:16:10 +00:00
parent 6b947a98e4 13ec8e701f
commit 838155400a
7 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/nfs/dir.c
+2
View File
@@ -3265,6 +3265,8 @@ static int nfs_open_permission_mask(int openflags)
mask |= MAY_READ;
if ((openflags & O_ACCMODE) != O_RDONLY)
mask |= MAY_WRITE;
if (openflags & O_TRUNC)
mask |= MAY_WRITE;
}
return mask;
fs/nfs/flexfilelayout/flexfilelayout.c
+4
View File
@@ -460,6 +460,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
if (!p)
goto out_err_free;
fh_count = be32_to_cpup(p);
if (fh_count == 0) {
rc = -EINVAL;
goto out_err_free;
}
fls->mirror_array[i]->fh_versions =
kcalloc(fh_count, sizeof(struct nfs_fh),
fs/nfs/pnfs.c
+1 -1
View File
@@ -2217,11 +2217,11 @@ lookup_again:
dprintk("%s wait for layoutreturn\n", __func__);
lseg = ERR_PTR(pnfs_prepare_to_retry_layoutget(lo));
if (!IS_ERR(lseg)) {
pnfs_put_layout_hdr(lo);
dprintk("%s retrying\n", __func__);
trace_pnfs_update_layout(ino, pos, count, iomode, lo,
lseg,
PNFS_UPDATE_LAYOUT_RETRY);
pnfs_put_layout_hdr(lo);
goto lookup_again;
}
trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
fs/nfs/pnfs_nfs.c
+2 -2
View File
@@ -1054,14 +1054,14 @@ nfs4_decode_mp_ds_addr(struct net *net, struct xdr_stream *xdr, gfp_t gfp_flags)
/* r_netid */
nlen = xdr_stream_decode_string_dup(xdr, &netid, XDR_MAX_NETOBJ,
gfp_flags);
if (unlikely(nlen < 0))
if (unlikely(nlen <= 0))
goto out_err;
/* r_addr: ip/ip6addr with port in dec octets - see RFC 5665 */
/* port is ".ABC.DEF", 8 chars max */
rlen = xdr_stream_decode_string_dup(xdr, &buf, INET6_ADDRSTRLEN +
IPV6_SCOPE_ID_LEN + 8, gfp_flags);
if (unlikely(rlen < 0))
if (unlikely(rlen <= 0))
goto out_free_netid;
/* replace port '.' with '-' */
fs/nfsd/nfs2acl.c
+12 -5
View File
@@ -131,10 +131,7 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst *rqstp)
resp->status = fh_getattr(fh, &resp->stat);
out:
/* argp->acl_{access,default} may have been allocated in
nfssvc_decode_setaclargs. */
posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default);
/* argp->acl_{access,default} are released in nfsaclsvc_release_setacl. */
return rpc_success;
out_drop_lock:
@@ -310,6 +307,16 @@ static void nfsaclsvc_release_access(struct svc_rqst *rqstp)
fh_put(&resp->fh);
}
static void nfsaclsvc_release_setacl(struct svc_rqst *rqstp)
{
struct nfsd3_setaclargs *argp = rqstp->rq_argp;
struct nfsd_attrstat *resp = rqstp->rq_resp;
fh_put(&resp->fh);
posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default);
}
#define ST 1 /* status*/
#define AT 21 /* attributes */
#define pAT (1+AT) /* post attributes - conditional */
@@ -343,7 +350,7 @@ static const struct svc_procedure nfsd_acl_procedures2[5] = {
.pc_func = nfsacld_proc_setacl,
.pc_decode = nfsaclsvc_decode_setaclargs,
.pc_encode = nfssvc_encode_attrstatres,
.pc_release = nfssvc_release_attrstat,
.pc_release = nfsaclsvc_release_setacl,
.pc_argsize = sizeof(struct nfsd3_setaclargs),
.pc_argzero = sizeof(struct nfsd3_setaclargs),
.pc_ressize = sizeof(struct nfsd_attrstat),
fs/nfsd/nfs3acl.c
+12 -5
View File
@@ -118,10 +118,7 @@ out_drop_lock:
out_errno:
resp->status = nfserrno(error);
out:
/* argp->acl_{access,default} may have been allocated in
nfs3svc_decode_setaclargs. */
posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default);
/* argp->acl_{access,default} are released in nfs3svc_release_setacl. */
return rpc_success;
}
@@ -223,6 +220,16 @@ static void nfs3svc_release_getacl(struct svc_rqst *rqstp)
posix_acl_release(resp->acl_default);
}
static void nfs3svc_release_setacl(struct svc_rqst *rqstp)
{
struct nfsd3_setaclargs *argp = rqstp->rq_argp;
struct nfsd3_attrstat *resp = rqstp->rq_resp;
fh_put(&resp->fh);
posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default);
}
#define ST 1 /* status*/
#define AT 21 /* attributes */
#define pAT (1+AT) /* post attributes - conditional */
@@ -256,7 +263,7 @@ static const struct svc_procedure nfsd_acl_procedures3[3] = {
.pc_func = nfsd3_proc_setacl,
.pc_decode = nfs3svc_decode_setaclargs,
.pc_encode = nfs3svc_encode_setaclres,
.pc_release = nfs3svc_release_fhandle,
.pc_release = nfs3svc_release_setacl,
.pc_argsize = sizeof(struct nfsd3_setaclargs),
.pc_argzero = sizeof(struct nfsd3_setaclargs),
.pc_ressize = sizeof(struct nfsd3_attrstat),
fs/nfsd/nfs4layouts.c
+1 -3
View File
@@ -258,9 +258,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
BUG_ON(!ls->ls_file);
if (nfsd4_layout_setlease(ls)) {
nfsd_file_put(ls->ls_file);
put_nfs4_file(fp);
kmem_cache_free(nfs4_layout_stateid_cache, ls);
nfs4_put_stid(stp);
return NULL;
}