CVE-2021-47506

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix use-after-free due to delegation race

A delegation break could arrive as soon as weve called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru.

Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread.

I suspect aba2072f4523 nfsd: grant read delegations to clients holding writes made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So Im not sure where the bug was introduced; it may have been there from the beginning.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/04a8d07f3d58308b92630045560799a3faa3ebce
• https://git.kernel.org/stable/c/148c816f10fd11df27ca6a9b3238cdd42fa72cd3
• https://git.kernel.org/stable/c/2becaa990b93cbd2928292c0b669d3abb6cf06d4
• https://git.kernel.org/stable/c/33645d3e22720cac1e4548f8fef57bf0649536ee
• https://git.kernel.org/stable/c/348714018139c39533c55661a0c7c990671396b4
• https://git.kernel.org/stable/c/548ec0805c399c65ed66c6641be467f717833ab5
• https://git.kernel.org/stable/c/e0759696de6851d7536efddfdd2dfed4c4df1f09
• https://git.kernel.org/stable/c/eeb0711801f5e19ef654371b627682aed3b11373
• https://git.kernel.org/stable/c/04a8d07f3d58308b92630045560799a3faa3ebce
• https://git.kernel.org/stable/c/148c816f10fd11df27ca6a9b3238cdd42fa72cd3
• https://git.kernel.org/stable/c/2becaa990b93cbd2928292c0b669d3abb6cf06d4
• https://git.kernel.org/stable/c/33645d3e22720cac1e4548f8fef57bf0649536ee
• https://git.kernel.org/stable/c/348714018139c39533c55661a0c7c990671396b4
• https://git.kernel.org/stable/c/548ec0805c399c65ed66c6641be467f717833ab5
• https://git.kernel.org/stable/c/e0759696de6851d7536efddfdd2dfed4c4df1f09
• https://git.kernel.org/stable/c/eeb0711801f5e19ef654371b627682aed3b11373