CVE-2025-40273

In the Linux kernel, the following vulnerability has been resolved:

NFSD: free copynotify stateid in nfs4freeol_stateid()

Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period.

However, in case when the server got an OPEN (which created a parent stateid), followed by a COPYNOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATESESSION would force expire previous state of this client. It leads to the open state being freed thru releaseopenowner-> nfs4freeolstateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred

WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4freeol_stateid+0xb0/0x100 [nfsd]

This patch, instead, frees the associated copynotify stateid here.

If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later.

[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlinkqueue nfnetlinklog bluetooth cfg80211 rpcrdma rdmacm iwcm ibcm ibcore nfsd nfsacl lockd grace nfslocalio ext4 crc16 mbcache jbd2 overlay uinput sndseqdummy sndhrtimer qrtr rfkill vfat fat uvcvideo sndhdacodecgeneric videobuf2vmalloc videobuf2memops sndhdaintel uvc sndinteldspcfg videobuf2v4l2 videobuf2common sndhdacodec sndhdacore videodev sndhwdep sndseq mc sndseqdevice sndpcm sndtimer snd soundcore sg loop authrpcgss vsockloopback vmwvsockvirtiotransportcommon vmwvsockvmcitransport vmwvmci vsock xfs 8021q garp stp llc mrp nvme ghashce e1000e nvmecore srmod nvmekeyring nvmeauth cdrom vmwgfx drmttmhelper ttm sunrpc dmmirror dmregionhash dmlog iscsitcp libiscsitcp libiscsi scsitransportiscsi fuse dmmultipath dmmod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BADPAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __listdelentryvalidor_report+0x148/0x200 [ 1626.860601] lr : __listdelentryvalidor_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __listdelentryvalidorreport+0x148/0x200 (P) [ 1626.868876] freecpntfstatelocked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromatmain+0x24/0x60 [nfsd] [ 1626.870231] processonework+0x584/0x1050 [ 1626.870595] workerthread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] retfromfork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs