)]}'
{
  "commit": "bd1b6a2bd7a20942e299d2f009b562841e4f2b61",
  "tree": "4dd9ec3faf4c5c72a01f116033e429b31e6c024a",
  "parents": [
    "eb1853b46753585bf11d1ec589437af7463bf85d"
  ],
  "author": {
    "name": "NeilBrown",
    "email": "neil@brown.name",
    "time": "Wed Oct 08 09:52:25 2025 -0400"
  },
  "committer": {
    "name": "Chenglong Tang",
    "email": "chenglongtang@google.com",
    "time": "Sun Nov 30 14:55:19 2025 -0800"
  },
  "message": "nfsd: fix refcount leak in nfsd_set_fh_dentry()\n\n[ Upstream commit 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c ]\n\nnfsd exports a \"pseudo root filesystem\" which is used by NFSv4 to find\nthe various exported filesystems using LOOKUP requests from a known root\nfilehandle.  NFSv3 uses the MOUNT protocol to find those exported\nfilesystems and so is not given access to the pseudo root filesystem.\n\nIf a v3 (or v2) client uses a filehandle from that filesystem,\nnfsd_set_fh_dentry() will report an error, but still stores the export\nin \"struct svc_fh\" even though it also drops the reference (exp_put()).\nThis means that when fh_put() is called an extra reference will be dropped\nwhich can lead to use-after-free and possible denial of service.\n\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\nclient.  This bug can only be triggered by the client synthesising an\nincorrect filehandle.\n\nTo fix this we move the assignments to the svc_fh later, after all\npossible error cases have been detected.\n\nBUG\u003db/463624367\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-40212 in the Linux kernel.\n\nReported-and-tested-by: tianshuo han \u003chantianshuo233@gmail.com\u003e\nFixes: ef7f6c4904d0 (\"nfsd: move V4ROOT version check to nfsd_set_fh_dentry()\")\nSigned-off-by: NeilBrown \u003cneil@brown.name\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nChange-Id: Ic6bf40780bc7dc5a79b63aaf23afbb4aa51893d1\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/119545\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "854dcdc36b2ce61ad958e94f8b488a4e26026969",
      "old_mode": 33188,
      "old_path": "fs/nfsd/nfsfh.c",
      "new_id": "9e85fdccf85085ec92f5762be17a7c985e27a2b2",
      "new_mode": 33188,
      "new_path": "fs/nfsd/nfsfh.c"
    }
  ]
}