CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected

In the Linux kernel, the following vulnerability has been resolved:

filelock: Remove locks reliably when fcntl/close race is detected

When fcntlsetlk() races with close(), it removes the created lock with dolockfilewait(). However, LSMs can allow the first dolockfilewait() that created the lock while denying the second dolockfilewait() that tries to remove the lock. Separately, posixlockfile() could also fail to remove a lock due to GFPKERNEL allocation failure (when splitting a range in the middle).

After the bug has been triggered, use-after-free reads will occur in lockgetstatus() when userspace reads /proc/locks. This can likely be used to read arbitrary kernel memory, but can't corrupt kernel memory.

Fix it by calling locksremoveposix() instead, which is designed to reliably get rid of POSIX locks associated with the given file and filesstruct and is also used by filpflush().

— NVD

Linux Kernel is vulnerable to a denial of service, caused by improper locking flaw when fcntl/close race is detected. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

— IBM