Linux: nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
What fixes it
- 1aea0482b98ecd7d0249204665f2ad4ad517f66bLinuxCVE List
- 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() is missing a read memory barrier (smp_rmb) before its second counter check. The standard kernel read_seqcount_retry() includes smp_rmb() to ensure that all data reads complete before the counter is re-checked.
Without this barrier, on weakly-ordered architectures (ARM, POWER), the CPU may reorder field reads past the second counter check, making the retry logic ineffective: it could observe a consistent counter pair while reading fields that have been concurrently modified by the writer.
Add smp_rmb() before the second counter check to order the field reads ahead of it, matching the barrier semantics of the standard seqcount read-side. The begin-side smp_load_acquire() already pairs with the smp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering the field reads, the retry check no longer needs acquire semantics and reads the counter with a plain READ_ONCE(), as read_seqcount_retry() does.
[ cel: Use READ_ONCE instead of smp_load_acquire() ]
Text from CVE List
Affected versions 10
- Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before f501f2f4ec1d2dfe39e21c98630314074a9b30b0CVE List
- Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before 1aea0482b98ecd7d0249204665f2ad4ad517f66bCVE List
- Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before 9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8CVE List
- Linuxaffected: bd9d6a3efa9709e653aafbeb859289feccb8e70c before a71f161a857117e8e0264deb7d14fff5c98adcf5CVE List
- Linuxaffected: 6.7CVE List
- Linuxunaffected: all versions before 6.7CVE List
- Linuxunaffected: 6.12.109 through 6.12.*CVE List
- Linuxunaffected: 6.18.50 through 6.18.*CVE List
- Linuxunaffected: 7.2.4 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List
References 4
- git.kernel.org/stable/c/f501f2f4ec1d2dfe39e21c98630314074a9b30b0Referencevia CVE List
- git.kernel.org/stable/c/1aea0482b98ecd7d0249204665f2ad4ad517f66bReferencevia CVE List
- git.kernel.org/stable/c/9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8Referencevia CVE List
- git.kernel.org/stable/c/a71f161a857117e8e0264deb7d14fff5c98adcf5Referencevia CVE List