Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <68b65889-3b2c-fb72-a0a8-d0afc15a03e0@huawei.com>
Date:   Tue, 29 Mar 2022 22:32:12 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.1
Subject: Re: [PATCH -next 0/2] fix nfsv4 bugs of opening with O_ACCMODE flag
To:     <trond.myklebust@hammerspace.com>, <anna@kernel.org>,
        <bjschuma@netapp.com>
CC:     <linux-nfs@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <liuyongqiang13@huawei.com>, <yi.zhang@huawei.com>,
        <zhangxiaoxu5@huawei.com>, <tao.lyu@epfl.ch>,
        ChenXiaoSong <chenxiaosong2@huawei.com>
References: <20220329113208.2466000-1-chenxiaosong2@huawei.com>
From:   "chenxiaosong (A)" <chenxiaosong2@huawei.com>
In-Reply-To: <20220329113208.2466000-1-chenxiaosong2@huawei.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

在 2022/3/29 19:32, ChenXiaoSong 写道:
> This series fixes following bugs:
> 
> When lseek() a file secondly opened with O_ACCMODE|O_DIRECT flags,
> nfs4_valid_open_stateid() will dereference NULL nfs4_state.
> 
> open() with O_ACCMODE|O_DIRECT flags secondly will fail.
> 
> ChenXiaoSong (2):
>    Revert "NFSv4: Handle the special Linux file open access mode"
>    NFSv4: fix open failure with O_ACCMODE flag
> 
>   fs/nfs/dir.c      | 10 ----------
>   fs/nfs/inode.c    |  1 -
>   fs/nfs/internal.h | 10 ++++++++++
>   fs/nfs/nfs4file.c |  6 ++++--
>   4 files changed, 14 insertions(+), 13 deletions(-)
> 

I wonder if these bugs related to 
[CVE-2022-24448](https://nvd.nist.gov/vuln/detail/CVE-2022-24448) ?

[Question about 
CVE-2022-24448](https://lore.kernel.org/all/1bb42908-8f58-bf56-c2da-42739ee48d16@huawei.com/T/)

Is there POC of patch ac795161c936 ("NFSv4: Handle case where the lookup 
of a directory fails") ?

CVE-2022-24448 Description:
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 
5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a 
regular file, nfs_atomic_open() performs a regular lookup. If a regular 
file is found, ENOTDIR should occur, but the server instead returns 
uninitialized data in the file descriptor.