7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wentao Liang commit 8ca3b74c0c447af17d0e27e76658a3d4cae3c5ba upstream. idtoname_lookup() returns the id-to-name cache entry with a new reference. The name is parsed between the lookup and the update call, and when the parsed name is malformed (negative length or longer than IDMAP_NAMESZ), idtoname_parse() jumps to the error label without dropping the reference returned by idtoname_lookup(), leaking the cache entry. Release the reference with cache_put() before taking the error exit. Fixes: f9ecc921b5b5 ("[PATCH] knfsd: Use new cache code for name/id lookup caches") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Jeff Layton Link: https://patch.msgid.link/20260917163154.2162438-1-vulab@iscas.ac.cn Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman --- fs/nfsd/nfs4idmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/nfsd/nfs4idmap.c +++ b/fs/nfsd/nfs4idmap.c @@ -253,8 +253,10 @@ idtoname_parse(struct cache_detail *cd, /* Name */ error = -EINVAL; len = qword_get(&buf, buf1, PAGE_SIZE); - if (len < 0 || len >= IDMAP_NAMESZ) + if (len < 0 || len >= IDMAP_NAMESZ) { + cache_put(&res->h, cd); goto out; + } if (len == 0) set_bit(CACHE_NEGATIVE, &ent.h.flags); else