)]}'
{
  "commit": "cb6e9768e9e55a0b6bba71db534b817294b0a3e5",
  "tree": "3342dde71dfeed173306da06a751f10490358c6f",
  "parents": [
    "39305ae0c6e8a5756a28f0bf7c966e36f110f487"
  ],
  "author": {
    "name": "NeilBrown",
    "email": "neil@brown.name",
    "time": "Wed Oct 08 09:52:25 2025 -0400"
  },
  "committer": {
    "name": "Cloud Image Release",
    "email": "cloud-image-release@prod.google.com",
    "time": "Sun Nov 30 15:01:31 2025 -0800"
  },
  "message": "nfsd: fix refcount leak in nfsd_set_fh_dentry()\n\n[ Upstream commit 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c ]\n\nnfsd exports a \"pseudo root filesystem\" which is used by NFSv4 to find\nthe various exported filesystems using LOOKUP requests from a known root\nfilehandle.  NFSv3 uses the MOUNT protocol to find those exported\nfilesystems and so is not given access to the pseudo root filesystem.\n\nIf a v3 (or v2) client uses a filehandle from that filesystem,\nnfsd_set_fh_dentry() will report an error, but still stores the export\nin \"struct svc_fh\" even though it also drops the reference (exp_put()).\nThis means that when fh_put() is called an extra reference will be dropped\nwhich can lead to use-after-free and possible denial of service.\n\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\nclient.  This bug can only be triggered by the client synthesising an\nincorrect filehandle.\n\nTo fix this we move the assignments to the svc_fh later, after all\npossible error cases have been detected.\n\nBUG\u003db/463623427\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-40212 in the Linux kernel.\n\ncos-patch: security-high\nReported-and-tested-by: tianshuo han \u003chantianshuo233@gmail.com\u003e\nFixes: ef7f6c4904d0 (\"nfsd: move V4ROOT version check to nfsd_set_fh_dentry()\")\nSigned-off-by: NeilBrown \u003cneil@brown.name\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nChange-Id: Ic6bf40780bc7dc5a79b63aaf23afbb4aa51893d1\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/119546\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/119621\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "854dcdc36b2ce61ad958e94f8b488a4e26026969",
      "old_mode": 33188,
      "old_path": "fs/nfsd/nfsfh.c",
      "new_id": "9e85fdccf85085ec92f5762be17a7c985e27a2b2",
      "new_mode": 33188,
      "new_path": "fs/nfsd/nfsfh.c"
    }
  ]
}