CVE-2025-68372

In the Linux kernel, the following vulnerability has been resolved:

nbd: defer config put in recv_work

There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and

NBD_CMD_RECONFIGURE:

nbd_genl_connect // conf_ref=2 (connect and recv_work A)

nbd_open // conf_ref=3

recv_work A done // conf_ref=2

NBD_CLEAR_SOCK // conf_ref=1

nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)

close nbd // conf_ref=1

recv_work B

config_put // conf_ref=0

atomic_dec(&config->recv_threads); -> UAF

Or only running NBD_CLEAR_SOCK:

nbd_genl_connect // conf_ref=2

nbd_open // conf_ref=3

NBD_CLEAR_SOCK // conf_ref=2

close nbd

nbd_release

config_put // conf_ref=1

recv_work

config_put // conf_ref=0

atomic_dec(&config->recv_threads); -> UAF

Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the

waiter") moved nbd_config_put() to run before waking up the waiter in

recv_work, in order to ensure that nbd_start_device_ioctl() would not

be woken up while nbd->task_recv was still uncleared.

However, in nbd_start_device_ioctl(), after being woken up it explicitly

calls flush_workqueue() to make sure all current works are finished.

Therefore, there is no need to move the config put ahead of the wakeup.

Move nbd_config_put() to the end of recv_work, so that the reference is

held for the whole lifetime of the worker thread. This makes sure the

config cannot be freed while recv_work is still running, even if clear

+ reconfigure interleave.

In addition, we don't need to worry about recv_work dropping the last

nbd_put (which causes deadlock):

path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):

connect // nbd_refs=1 (trigger recv_work)

open nbd // nbd_refs=2

NBD_CLEAR_SOCK

close nbd

nbd_release

nbd_disconnect_and_put

flush_workqueue // recv_work done

nbd_config_put

nbd_put // nbd_refs=1

nbd_put // nbd_refs=0

queue_work

path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):

connect // nbd_refs=2 (trigger recv_work)

open nbd // nbd_refs=3

NBD_CLEAR_SOCK // conf_refs=2

close nbd

nbd_release

nbd_config_put // conf_refs=1

nbd_put // nbd_refs=2

recv_work done // conf_refs=0, nbd_refs=1

rmmod // nbd_refs=0

Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")