From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A5573A6F1B; Mon, 22 Jun 2026 12:29:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782131344; cv=none; b=UMYNUtb4NUWS/aFzKcDwi5MNe3mJoYq+dnms6FRtYo8fpIBBWn1XnXB+xp0mCPEyEA+5KaLO2hZRXgCUG9NlKMdU9dC0QuXLDVqvr1NWSD/X3zwMoZEiIGjq7pq9x2V1pKXbD334w3V3hheqrLWB1yJDeuppFaJz+xJcXPoP/HM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782131344; c=relaxed/simple; bh=xkugHQypCX6nYTKU7gH9b2FnLvmc+ANMCkzRrv6R8u0=; h=Message-ID:Date:MIME-Version:Subject:To:CC:References:From: In-Reply-To:Content-Type; b=OeDpJD4PzZVa55mzhj4wPhxTe714KmDXaGT6OZz5Srazq4h7AC9lQNRgFI8dTw1GT+khakZLv4Tpph7/WlabLgXTRIAozEcA2e91F29IXm+6HqSxsDNkfcSzGU+VAeALKnD1DHaim/2g39KJAbodE6BgFOM4D6J/tWgOfD3I5S0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=A7HB7fxg; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="A7HB7fxg" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=+7DjBGMXK44clag/HE0NJjphmPo7aolTXioF+IA3Mp4=; b=A7HB7fxgYbXiTEg46scGeXrCjMeQyZd8oumf0DijJW2jYFOKyR4GwBQfwVIB9ZSbACs/Fb/vt ODvlySATDx/cZuW5Z2fXtRciToYOy8YkCaflosmT1vcc9Mqif7x6FUSmAPPPwOhNvAQDImjpvCl MydpWrAbDwPBnT2iS9Z1fjU= Received: from mail.maildlp.com (unknown [172.19.162.92]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4gkS1w3g06zmV7K; Mon, 22 Jun 2026 20:19:48 +0800 (CST) Received: from kwepemf100006.china.huawei.com (unknown [7.202.181.220]) by mail.maildlp.com (Postfix) with ESMTPS id D8DA940562; Mon, 22 Jun 2026 20:28:52 +0800 (CST) Received: from [10.174.176.240] (10.174.176.240) by kwepemf100006.china.huawei.com (7.202.181.220) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Mon, 22 Jun 2026 20:28:52 +0800 Message-ID: Date: Mon, 22 Jun 2026 20:28:51 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: CVE-2026-31404: NFSD: Defer sub-object cleanup in export put callbacks To: , , CC: Greg Kroah-Hartman , Jeff Layton , yangerkun References: <2026040328-CVE-2026-31404-f58a@gregkh> From: yangerkun In-Reply-To: <2026040328-CVE-2026-31404-f58a@gregkh> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To kwepemf100006.china.huawei.com (7.202.181.220) Hi all, This commit has been reverted since it does not fix any problem, should this CVE be rejected too? commit 516403d4d85607fdef3ca41d4a56b54e5566fa9a Author: Yang Erkun Date: Wed May 13 10:42:52 2026 +0800 Revert "NFSD: Defer sub-object cleanup in export put callbacks" This reverts commit 48db892356d6cb80f6942885545de4a6dd8d2a29. Thanks, Erkun. 在 2026/4/3 23:19, Greg Kroah-Hartman 写道: > From: Greg Kroah-Hartman > > Description > =========== > > In the Linux kernel, the following vulnerability has been resolved: > > NFSD: Defer sub-object cleanup in export put callbacks > > svc_export_put() calls path_put() and auth_domain_put() immediately > when the last reference drops, before the RCU grace period. RCU > readers in e_show() and c_show() access both ex_path (via > seq_path/d_path) and ex_client->name (via seq_escape) without > holding a reference. If cache_clean removes the entry and drops the > last reference concurrently, the sub-objects are freed while still > in use, producing a NULL pointer dereference in d_path. > > Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or > ex_stats") moved kfree of ex_uuid and ex_stats into the > call_rcu callback, but left path_put() and auth_domain_put() running > before the grace period because both may sleep and call_rcu > callbacks execute in softirq context. > > Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the > callback until after the RCU grace period and executes it in process > context where sleeping is permitted. This allows path_put() and > auth_domain_put() to be moved into the deferred callback alongside > the other resource releases. Apply the same fix to expkey_put(), > which has the identical pattern with ek_path and ek_client. > > A dedicated workqueue scopes the shutdown drain to only NFSD > export release work items; flushing the shared > system_unbound_wq would stall on unrelated work from other > subsystems. nfsd_export_shutdown() uses rcu_barrier() followed > by flush_workqueue() to ensure all deferred release callbacks > complete before the export caches are destroyed. > > Reviwed-by: Jeff Layton > > The Linux kernel CVE team has assigned CVE-2026-31404 to this issue. > > > Affected and fixed versions > =========================== > > Issue introduced in 6.14 with commit c224edca7af028828e2ad866b61d731b5e72b46d and fixed in 6.18.20 with commit 2829e80d29b627886d12b5ea40856d56b516e67d > Issue introduced in 6.14 with commit c224edca7af028828e2ad866b61d731b5e72b46d and fixed in 6.19.10 with commit f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 > Issue introduced in 6.14 with commit c224edca7af028828e2ad866b61d731b5e72b46d and fixed in 7.0-rc5 with commit 48db892356d6cb80f6942885545de4a6dd8d2a29 > > Please see https://www.kernel.org for a full list of currently supported > kernel versions by the kernel community. > > Unaffected versions might change over time as fixes are backported to > older supported kernel versions. The official CVE entry at > https://cve.org/CVERecord/?id=CVE-2026-31404 > will be updated if fixes are backported, please check that for the most > up to date information about this issue. > > > Affected files > ============== > > The file(s) affected by this issue are: > fs/nfsd/export.c > fs/nfsd/export.h > fs/nfsd/nfsctl.c > > > Mitigation > ========== > > The Linux kernel CVE team recommends that you update to the latest > stable kernel version for this, and many other bugfixes. Individual > changes are never tested alone, but rather are part of a larger kernel > release. Cherry-picking individual commits is not recommended or > supported by the Linux kernel community at all. If however, updating to > the latest release is impossible, the individual changes to resolve this > issue can be found at these commits: > https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d > https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 > https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 >