Merge: nfsd: clear acl_access/acl_default after releasing them

caringi · caringi · commit 81b77c437759 · 2025-04-04T12:34:53.000-03:00
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6512 nfsd: clear acl_access/acl_default after releasing them JIRA: https://issues.redhat.com/browse/RHEL-81523 CVE: CVE-2025-21796 Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Approved-by: Scott Mayhew <smayhew@redhat.com> Approved-by: Benjamin Coddington <bcodding@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Augusto Caringi <acaringi@redhat.com>
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
@@ -84,6 +84,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp)
 fail:
 	posix_acl_release(resp->acl_access);
 	posix_acl_release(resp->acl_default);
+	resp->acl_access = NULL;
+	resp->acl_default = NULL;
 	goto out;
 }
 
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
@@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp)
 fail:
 	posix_acl_release(resp->acl_access);
 	posix_acl_release(resp->acl_default);
+	resp->acl_access = NULL;
+	resp->acl_default = NULL;
 	goto out;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -84,6 +84,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp)`
`84`	`84`	`fail:`
`85`	`85`	`posix_acl_release(resp->acl_access);`
`86`	`86`	`posix_acl_release(resp->acl_default);`
	`87`	`+ resp->acl_access = NULL;`
	`88`	`+ resp->acl_default = NULL;`
`87`	`89`	`goto out;`
`88`	`90`	`}`
`89`	`91`
Original file line number	Diff line number	Diff line change
`@@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp)`
`76`	`76`	`fail:`
`77`	`77`	`posix_acl_release(resp->acl_access);`
`78`	`78`	`posix_acl_release(resp->acl_default);`
	`79`	`+ resp->acl_access = NULL;`
	`80`	`+ resp->acl_default = NULL;`
`79`	`81`	`goto out;`
`80`	`82`	`}`
`81`	`83`