CVE-2025-39697: NFS: Fix a race when updating an existing write

CKI Backport Botrequested to merge
redhat/red-hat-ci-tools/kernel/bot-branches/centos-stream/src/kernel/centos-stream-10:backport-RHEL-113858-centos-stream-10-main into main

JIRA: https://issues.redhat.com/browse/RHEL-113858
CVE: CVE-2025-39697

commit 76d2e3890fb169168c73f2e4f8375c7cc24a765e
Author: Trond Myklebust <trond.myklebust@hammerspace.com>
Date:   Sat Aug 16 07:25:20 2025 -0700

    NFS: Fix a race when updating an existing write
    
    After nfs_lock_and_join_requests() tests for whether the request is
    still attached to the mapping, nothing prevents a call to
    nfs_inode_remove_request() from succeeding until we actually lock the
    page group.
    The reason is that whoever called nfs_inode_remove_request() doesn't
    necessarily have a lock on the page group head.
    
    So in order to avoid races, let's take the page group lock earlier in
    nfs_lock_and_join_requests(), and hold it across the removal of the
    request in nfs_inode_remove_request().
    
    Reported-by: Jeff Layton <jlayton@kernel.org>
    Tested-by: Joe Quanaim <jdq@meta.com>
    Tested-by: Andrew Steffen <aksteffen@meta.com>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Fixes: bd37d6fce184 ("NFSv4: Convert nfs_lock_and_join_requests() to use nfs_page_find_head_request()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

Signed-off-by: CKI Backport Bot cki-ci-bot+cki-gitlab-backport-bot@redhat.com

Created 2025-09-09 22:21 UTC by backporter - KWF FAQ - Slack #team-kernel-workflow - Source - Documentation - Report an issue

Merge request reports