Linux Kernel NFS NULL Pointer Dereference Vulnerability in Request Initialization

A vulnerability in the Linux kernel's NFS implementation could lead to a NULL pointer dereference. This issue arises when netfslib attempts to copy data that has just been read for NFS. It creates a new write request and initializes it using nfs_netfs_init_request(), but without a valid file pointer. This omission causes nfs_file_open_context() to encounter a NULL pointer dereference. Although the NFS context is not needed for writing to the cache, the absence of a file pointer leads to a crash. The vulnerability has been addressed by modifying the request initialization function to return early when no file pointer is provided, while also issuing a warning if the request was intended for a purpose other than copying to cache. Additionally, the request cleanup function has been corrected to avoid attempting to free a NULL context pointer.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a kernel oops, which can disrupt system operations and potentially be exploited to escalate privileges.