netfs: fix reference leak
Résumé
netfs: fix reference leak
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In the Linux kernel, the following vulnerability has been resolved:
netfs: fix reference leak
Commit 20d72b00ca81 ("netfs: Fix the request's work item to not
require a ref") modified netfs_alloc_request() to initialize the
reference counter to 2 instead of 1. The rationale was that the
requet's "work" would release the second reference after completion
(via netfs_{read,write}_collection_worker()). That works most of the
time if all goes well.
However, it leaks this additional reference if the request is released
before the I/O operation has been submitted: the error code path only
decrements the reference counter once and the work item will never be
queued because there will never be a completion.
This has caused outages of our whole server cluster today because
tasks were blocked in netfs_wait_for_outstanding_io(), leading to
deadlocks in Ceph (another bug that I will address soon in another
patch). This was caused by a netfs_pgpriv2_begin_copy_to_cache() call
which failed in fscache_begin_write_operation(). The leaked
netfs_io_request was never completed, leaving netfs_inode.io_count
with a positive value forever.
All of this is super-fragile code. Finding out which code paths will
lead to an eventual completion and which do not is hard to see:
-
Some functions like netfs_create_write_req() allocate a request, but
will never submit any I/O. -
netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()
and then netfs_put_request(); however, netfs_unbu…
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2025-40007 linux-lts Corrigé dans: 6.18.35-r1
- Debian DEBIAN-CVE-2025-40007 linux Corrigé dans: 6.16.10-1
- Ubuntu UBUNTU-CVE-2025-40007 linux-hwe-edge
Références
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org