[SRU][N][PATCH 0/1] CVE-2024-53173

[Bethany Jamison]

[Impact]

NFSv4.0: Fix a use-after-free problem in the asynchronous open()

When two threads are opening files at the same time, and are forced to 
abort before a reply is seen, they call to nfs_release_seqid() in 
nfs4_opendata_free() which can result in a use-after-free of the pointer 
to the defunct rpc task of the other thread.
The fix is to ensure that if the RPC call is aborted before the call to
nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()
in nfs4_open_release() before the rpc_task is freed.

[Fix]

Oracular: released
Noble:	  Clean cherry-pick from linux-6.11.y
Jammy:	  pending (5.15.0-135.146)
Focal:	  pending (5.4.0-210.230)
Bionic:	  fix sent to esm ML
Xenial:	  fix sent to esm ML
Trusty:	  not fixed as it is not a critical CVE

This is technically a resubmitted patchset to the ML. I put the wrong CVE
ID in the subject line - I won't mark it as a v2 because this CVE ID has not
been seen on the ML yet though.

[Test Case]

Compile and boot tested.

[Where problems could occur]

The fix affects those who use client-side procedure declarations for NFSv4,
and issue with this fix would be visible to the user via unexpected system
behavior.

Trond Myklebust (1):
  NFSv4.0: Fix a use-after-free problem in the asynchronous open()

 fs/nfs/nfs4proc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

-- 
2.43.0