From: Zhansong Gao <zhsgao@hotmail.com> mainline inclusion from mainline-v7.3-rc1 commit 468e458ffde907ba19acd2102ca1fbb8f6fbede2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19420 CVE: CVE-2026-90148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- When nfs4_add_lease() races with a delegation return, it calls nfs4_delete_lease() to clean up. Previously, it passed priv, which can legitimately be NULL. Passing a NULL priv eventually leads to a NULL pointer dereference in generic_setlease(). Fixes: e93a5e9306a5 ("NFSv4: Add support for application leases underpinned by a delegation") Signed-off-by: Zhansong Gao <zhsgao@hotmail.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Conflicts: fs/nfs/nfs4proc.c [Commit 468e458ffde9 uses (*lease)->c.flc_owner from the newer struct file_lease; this tree still uses struct file_lock, so read the owner from the fl_owner field instead.] Co-authored-by: BackportAgent@deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot@huawei.com> Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com> --- fs/nfs/nfs4proc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 55717d9a19cd2..34aaaf9d31b12 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -7635,6 +7635,7 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lock **lease, { struct inode *inode = file_inode(file); fmode_t type = arg == F_RDLCK ? FMODE_READ : FMODE_WRITE; + fl_owner_t owner = (*lease)->fl_owner; int ret; /* No delegation, no lease */ @@ -7644,7 +7645,8 @@ static int nfs4_add_lease(struct file *file, int arg, struct file_lock **lease, if (ret || nfs4_have_delegation(inode, type)) return ret; /* We raced with a delegation return */ - nfs4_delete_lease(file, priv); + dprintk("%s: raced with a delegation return\n", __func__); + nfs4_delete_lease(file, &owner); return -EAGAIN; } -- 2.43.0