Commit 33c05595 authored Aug 22, 2024 by Long Li

filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64

maillist inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IALNC4
CVE: NA

Reference: https://lore.kernel.org/stable/20240816050627.2122228-1-leo.lilong@huawei.com/T/



----------------------------------------

The locks_remove_posix() function in fcntl_setlk/fcntl_setlk64 is designed
to reliably remove locks when an fcntl/close race is detected. However, it
was passing in the wrong filelock owner, it looks like a mistake and
resulting in a failure to remove locks. More critically, if the lock
removal fails, it could lead to a uaf issue while traversing the locks.

This problem occurs only in the 4.19/5.4 stable version.

Fixes: a561145f3ae9 ("filelock: Fix fcntl/close race recovery compat path")
Fixes: d30ff3304083 ("filelock: Remove locks reliably when fcntl/close race is detected")
Cc: stable@vger.kernel.org
Signed-off-by: Long Li <leo.lilong@huawei.com>

parent 611f0fce

fs/locks.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2314,7 +2314,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
		f = fcheck(fd);
		spin_unlock(&current->files->file_lock);
		if (f != filp) {
		locks_remove_posix(filp, &current->files);
		locks_remove_posix(filp, current->files);
		error = -EBADF;
		}
		}
		@@ -2444,7 +2444,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
		f = fcheck(fd);
		spin_unlock(&current->files->file_lock);
		if (f != filp) {
		locks_remove_posix(filp, &current->files);
		locks_remove_posix(filp, current->files);
		error = -EBADF;
		}
		}