diff --git a/0007-fix-compiler-warnings-in-mount.cifs.patch b/0007-fix-compiler-warnings-in-mount.cifs.patch new file mode 100644 index 0000000000000000000000000000000000000000..3d106a24d47d3fc7ac9648e06ead38e899921ee0 --- /dev/null +++ b/0007-fix-compiler-warnings-in-mount.cifs.patch @@ -0,0 +1,46 @@ +From 490e018484efc8db4d00ec6efa72d95c093be575 Mon Sep 17 00:00:00 2001 +From: Rafi KC +Date: Tue, 18 Feb 2025 15:34:11 +0530 +Subject: [PATCH] api/glfs: Fix use after free in readdir (#4477) + +There is a code path in glfs readdir where we might end up +using a free'ed memory. A possible case is when we use the +fd to read the offset 0 after reading the content at least +once, and the during the second time, the readdir return 0, +probably due to the contents got deleted. + +Change-Id: I08fa6cc9b924b90597ef4498e081cae9339fbd6a +Fixes: #3955 + +Signed-off-by: Mohammed Rafi KC +--- + api/src/glfs-fops.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/api/src/glfs-fops.c b/api/src/glfs-fops.c +index e6adea5..faaaa32 100644 +--- a/api/src/glfs-fops.c ++++ b/api/src/glfs-fops.c +@@ -50,6 +50,7 @@ glfs_mark_glfd_for_deletion(struct glfs_fd *glfd) + LOCK(&glfd->lock); + { + glfd->state = GLFD_CLOSE; ++ glfd->next = NULL; + } + UNLOCK(&glfd->lock); + +@@ -3734,6 +3735,11 @@ glfd_entry_refresh(struct glfs_fd *glfd, int plus) + } + + list_splice_init(&glfd->entries, &old.list); ++ /* If glfd->next is non null means, this entry is from the old ++ * list, there is no point in keeping the free'ed data. Hence ++ * set to NULL; ++ */ ++ glfd->next = NULL; + list_splice_init(&entries.list, &glfd->entries); + + /* spurious errno is dangerous for glfd_entry_next() */ +-- +2.43.0 + diff --git a/glusterfs.spec b/glusterfs.spec index 1fc2b8b27c3aab6bdc72456f5ef1c29b74846527..564a50295da8d409da8fd5b34b82b5edd0549dbb 100644 --- a/glusterfs.spec +++ b/glusterfs.spec @@ -3,7 +3,7 @@ Name: glusterfs Version: 7.0 -Release: 12 +Release: 13 License: GPLv2 and LGPLv3+ Summary: Aggregating distributed file system URL: http://docs.gluster.org/ @@ -17,6 +17,7 @@ Patch3: 0003-SC2081-can-t-match-globs-Use-or-grep.patch Patch4: 0004-fuse-Resolve-asan-bug-in-during-receive-event-notifi.patch Patch5: 0005-timer-fix-event-destruction-race.patch Patch6: 0006-dht-fix-asan-use-after-free-bug-4248.patch +Patch7: 0007-fix-compiler-warnings-in-mount.cifs.patch BuildRequires: systemd bison flex gcc make libtool ncurses-devel readline-devel libattr-devel BuildRequires: libxml2-devel openssl-devel libaio-devel libacl-devel python3-devel git perl @@ -465,6 +466,9 @@ exit 0 %{_mandir}/man8/*gluster*.8* %changelog +* Tue Oct 14 2025 zhangyaqi - 7.0-13 +- api/glfs: Fix use after free in readdir + * Wed Nov 22 2023 wangxiaomeng - 7.0-12 - fix CVE-2022-48340