Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READ_PLUS (again) I found that the read code might send multiple requests using the same nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is how we ended up occasionally double-freeing the scratch buffer, but also means we set a NULL pointer but non-zero length to the xdr scratch buffer. This results in an oops the first time decoding needs to copy something to scratch, which frequently happens when decoding READ_PLUS hole segments. I fix this by moving scratch handling into the pageio read code. I provide a function to allocate scratch space for decoding read replies, and free the scratch buffer when the nfs_pgio_header is freed.
Product status
886959f425b6a936a30b82a297ae3aecb3b8230f (git) before adac9f0ddd2b291c7ce41f549fdb27a13616cff5
fbd2a05f29a95d5b42b294bf47e55a711424965b (git) before a2f4cb206bd94b3f4a7bb05fcdce9525283b5681
fbd2a05f29a95d5b42b294bf47e55a711424965b (git) before ae5d5672f1db711e91db6f52df5cb16ecd8f5692
fbd2a05f29a95d5b42b294bf47e55a711424965b (git) before 303a78052091c81e9003915c521fdca1c7e117af
6.4
Any version before 6.4
6.4.16 (semver)
6.5.3 (semver)
6.6 (original_commit_for_fix)
References
git.kernel.org/...c/adac9f0ddd2b291c7ce41f549fdb27a13616cff5
git.kernel.org/...c/a2f4cb206bd94b3f4a7bb05fcdce9525283b5681
git.kernel.org/...c/ae5d5672f1db711e91db6f52df5cb16ecd8f5692
git.kernel.org/...c/303a78052091c81e9003915c521fdca1c7e117af
