Chuck LeverandGreg Kroah-Hartman cb3420c047 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure ...

commit 70a38f87be upstream.

The cached-file path in nlm_lookup_file() reaches the found: label
unconditionally, even when nlm_do_fopen() fails. At that label
*result and file->f_count are updated before the error is returned.
The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then
bail out of their switch without copying *result back to their
caller, so the proc handler's local nlm_file pointer remains NULL
and the cleanup path skips nlm_release_file(). The f_count
increment is never released, and nlm_traverse_files() can no
longer reap the file because its refcount never returns to zero
between requests.

Short-circuit the cached path so neither *result nor f_count is
touched when nlm_do_fopen() fails on a hashed nlm_file.

Fixes: 7f024fcd5c ("Keep read and write fds with each nlm_file")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:55:01 +02:00

..

clnt4xdr.c

…

clntlock.c

…

clntproc.c

…

clntxdr.c

…

host.c

…

Makefile

…

mon.c

…

netns.h

…

procfs.c

…

procfs.h

…

svc4proc.c

…

svc.c

…

svclock.c

…

svcproc.c

…

svcshare.c

…

svcsubs.c

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

2026-07-24 15:55:01 +02:00

svcxdr.h

…

xdr4.c

…

xdr.c

…