From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 13:50:00 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1cdadf783cc6d727eeeeebb168ea3c755e18e8e3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch nvdimm-btt-free-arenas-on-btt_init-error-paths.patch --- diff --git a/queue-5.10/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch b/queue-5.10/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch new file mode 100644 index 0000000000..504c63fdc7 --- /dev/null +++ b/queue-5.10/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch @@ -0,0 +1,38 @@ +From f16a1513452edb532fec81e591c64c320866719c Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 14 May 2026 16:56:04 -0400 +Subject: lockd: Plug nlm_file leak when nlm_do_fopen() fails + +From: Chuck Lever + +commit f16a1513452edb532fec81e591c64c320866719c upstream. + +A client can repeatedly drive nlm_do_fopen() failures by presenting +file handles that the underlying export rejects. After kzalloc_obj() +succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not +yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps +to out_unlock, which releases nlm_file_mutex and returns without +freeing the allocation, so each failure leaks one nlm_file. + +Route the failure through out_free so kfree() runs before the +function returns. + +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/lockd/svcsubs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -139,7 +139,7 @@ nlm_lookup_file(struct svc_rqst *rqstp, + + nfserr = nlm_do_fopen(rqstp, file, mode); + if (nfserr) +- goto out_unlock; ++ goto out_free; + + hlist_add_head(&file->f_list, &nlm_files[hash]); + diff --git a/queue-5.10/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch b/queue-5.10/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch new file mode 100644 index 0000000000..dee8ec1122 --- /dev/null +++ b/queue-5.10/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch @@ -0,0 +1,42 @@ +From 70a38f87bed7f0694fd07988b47b2db1e10d8df3 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 14 May 2026 16:56:06 -0400 +Subject: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure + +From: Chuck Lever + +commit 70a38f87bed7f0694fd07988b47b2db1e10d8df3 upstream. + +The cached-file path in nlm_lookup_file() reaches the found: label +unconditionally, even when nlm_do_fopen() fails. At that label +*result and file->f_count are updated before the error is returned. +The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then +bail out of their switch without copying *result back to their +caller, so the proc handler's local nlm_file pointer remains NULL +and the cleanup path skips nlm_release_file(). The f_count +increment is never released, and nlm_traverse_files() can no +longer reap the file because its refcount never returns to zero +between requests. + +Short-circuit the cached path so neither *result nor f_count is +touched when nlm_do_fopen() fails on a hashed nlm_file. + +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/lockd/svcsubs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -123,6 +123,8 @@ nlm_lookup_file(struct svc_rqst *rqstp, + mutex_lock(&file->f_mutex); + nfserr = nlm_do_fopen(rqstp, file, mode); + mutex_unlock(&file->f_mutex); ++ if (nfserr) ++ goto out_unlock; + goto found; + } + nlm_debug_print_fh("creating file for", &lock->fh); diff --git a/queue-5.10/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch b/queue-5.10/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch new file mode 100644 index 0000000000..382314274e --- /dev/null +++ b/queue-5.10/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch @@ -0,0 +1,41 @@ +From 13fe4cd9ddd0aacb7777812328be525a11ea3fea Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Tue, 19 May 2026 11:20:12 +0530 +Subject: nvdimm/btt: Free arena sub-allocations on discover_arenas() error path + +From: Abdun Nihaal + +commit 13fe4cd9ddd0aacb7777812328be525a11ea3fea upstream. + +Memory allocated by btt_freelist_init(), btt_rtt_init(), and +btt_maplocks_init() is not freed on some discover_arenas() error +paths. This leaks memory when arena discovery fails. + +Add the missing kfree() calls to release the allocations before +returning an error. + +[ as: commit message and log edits ] + +Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Alison Schofield +Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-1-592300fb7a43@cse.iitm.ac.in +Signed-off-by: Alison Schofield +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvdimm/btt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -923,6 +923,9 @@ static int discover_arenas(struct btt *b + return ret; + + out: ++ kfree(arena->freelist); ++ kfree(arena->rtt); ++ kfree(arena->map_locks); + kfree(arena); + free_arenas(btt); + out_super: diff --git a/queue-5.10/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch b/queue-5.10/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch new file mode 100644 index 0000000000..29f22892a6 --- /dev/null +++ b/queue-5.10/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch @@ -0,0 +1,72 @@ +From 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Tue, 19 May 2026 11:20:13 +0530 +Subject: nvdimm/btt: Free arenas on btt_init() error paths + +From: Abdun Nihaal + +commit 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 upstream. + +The arenas allocated by discover_arenas() or create_arenas() are not +freed on some error paths in btt_init(). This leaks memory when BTT +initialization fails. + +Call free_arenas() from the affected error paths to release the +allocations. + +[ as: commit message and log edits ] + +Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Alison Schofield +Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in +Signed-off-by: Alison Schofield +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvdimm/btt.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1615,7 +1615,7 @@ static struct btt *btt_init(struct nd_bt + if (btt->init_state != INIT_READY && nd_region->ro) { + dev_warn(dev, "%s is read-only, unable to init btt metadata\n", + dev_name(&nd_region->dev)); +- return NULL; ++ goto err; + } else if (btt->init_state != INIT_READY) { + btt->num_arenas = (rawsize / ARENA_MAX_SIZE) + + ((rawsize % ARENA_MAX_SIZE) ? 1 : 0); +@@ -1625,25 +1625,28 @@ static struct btt *btt_init(struct nd_bt + ret = create_arenas(btt); + if (ret) { + dev_info(dev, "init: create_arenas: %d\n", ret); +- return NULL; ++ goto err; + } + + ret = btt_meta_init(btt); + if (ret) { + dev_err(dev, "init: error in meta_init: %d\n", ret); +- return NULL; ++ goto err; + } + } + + ret = btt_blk_init(btt); + if (ret) { + dev_err(dev, "init: error in blk_init: %d\n", ret); +- return NULL; ++ goto err; + } + + btt_debugfs_init(btt); + + return btt; ++err: ++ free_arenas(btt); ++ return NULL; + } + + /** diff --git a/queue-5.10/series b/queue-5.10/series index 114ccdfc80..8c3be96328 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -469,3 +469,7 @@ batman-adv-frag-free-unfragmentable-packet.patch batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch batman-adv-tt-prevent-tvlv-oob-check-overflow.patch mfd-tps6586x-fix-of-node-refcount.patch +nvdimm-btt-free-arenas-on-btt_init-error-paths.patch +nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch +lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch +lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch