In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd_file objects are free

In the Linux kernel, the following vulnerability has been resolved:

nfsd: hold rcu across localio cmpxchg retry

nfsd_file objects are freed via call_rcu (filecache.c:296), and
nfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU
(KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page
backing a freed nfsd_file becomes freely reclaimable once the RCU
grace period elapses.

The again: retry block in nfsd_open_local_fh() loads a pointer with
cmpxchg and then calls nfsd_file_get(new) (which is
refcount_inc_not_zero) without holding rcu_read_lock. The sole caller
nfs_open_local_fh() drops rcu_read_lock before invoking this helper,
so no outer reader-side critical section covers the load.

 1CPU 0 (nfsd_open_local_fh)        CPU 1 (nfsd_file_put_local)
 2-----                             -----
 3new = cmpxchg(pnf, NULL, ...)
 4                                  nf = xchg(pnf, NULL)
 5                                  nfsd_file_put(nf)
 6                                    last ref -> call_rcu()
 7                                  /* grace period elapses;
 8                                     slab page recycled */
 9nfsd_file_get(new)
10  refcount_inc_not_zero(&new->nf_ref)
11  /* operates on recycled memory */

A non-zero word at the nf_ref offset of the recycled object makes the
refcount bump appear to succeed, and the caller then dereferences
new->nf_net and new->nf_file out of freed memory.

Fix by taking rcu_read_lock() immediately before the cmpxchg and
releasing it on all three exits of the if (new) block: the goto-again
retry, the lost-race cleanup path, and the install-succeeded path.
nfsd_file_put() and nfsd_net_put() stay outside the RCU section so
they remain free to block.