CVE-2026-72472

In the Linux kernel, the following vulnerability has been resolved:

nfs: use nfsi->rwsem to protect traversal of the file lock list

Lingfeng identified a bug and suggested two solutions, but both appear

to have issues.

Generally, we cannot release flc_lock while iterating over the file lock

list to avoid use-after-free (UAF) problems with file locks. However,

functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot

adhere to this rule because recover_lock or nfs4_lock_delegation_recall

may take a long time. To resolve this, NFS switches to using nfsi->rwsem

for the same protection, and nfs_reclaim_locks follows this approach.

Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead,

this is inadequate since a single inode can have multiple nfs4_state

instances. Therefore, the fix is to also use nfsi->rwsem in this case.

Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range

lock must be atomic with the stateid update"), the functions

nfs4_locku_done and nfs4_lock_done also break this rule because they

call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding

this protection could cause many deadlocks, so instead, the call to

locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug

fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range

lock must be atomic with the stateid update"), it has been resolved

after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering

state recovery") because all slots are drained before calling

nfs4_do_reclaim, which prevents concurrent stateid changes along this path.

Also, nfs_delegation_claim_locks does not cause this concurrency either

since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is

sent, so nfs4_lock_done is not called. Therefore,

nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first

time the stateid is set.