Skip to content

Commit 3e4c5d5

Browse files
committed
nfsd: don't ignore the return code of svc_proc_register()
jira VULN-64896 cve CVE-2025-22026 commit-author Jeff Layton <[email protected]> commit 930b64c upstream-diff | nfsd underwent considerable architectural changes related to the exposition of network stats in the user space since `ciqlts9_4' branched off, which are assumed by the upstream fix 930b64c to be in place - see patches d98416c, 93483ac, 4b14885, e41ee44, 16fb980. This backport addresses the core of the issue without pulling in all of these changes, which is checking the value returned by `svc_proc_register'. Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later. Fix nfsd_proc_stat_init() to return the same type of pointer as svc_proc_register(), and fix up nfsd_net_init() to check that and fail the nfsd_net construction if it occurs. svc_proc_register() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsd_net construction codepath, so if this happens, return -ENOMEM. Reported-by: [email protected] Closes: https://lore.kernel.org/linux-nfs/[email protected]/ Cc: [email protected] # v6.9 Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Chuck Lever <[email protected]> (cherry picked from commit 930b64c) Signed-off-by: Marcin Wcisło <[email protected]>
1 parent d14abc6 commit 3e4c5d5

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

fs/nfsd/stats.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,8 @@ int nfsd_stat_init(void)
126126
if (err)
127127
return err;
128128

129-
svc_proc_register(&init_net, &nfsd_svcstats, &nfsd_proc_ops);
129+
if (!svc_proc_register(&init_net, &nfsd_svcstats, &nfsd_proc_ops))
130+
return -ENOMEM;
130131

131132
return 0;
132133
}

0 commit comments

Comments
 (0)