CVE-2021-47322

What it actually does

Null or invalid request pointer dereference in pnfs_mark_request_commit() during commit list rescheduling after pNFS write failure when O_DIRECT is in use, resulting in kernel oops.

Why it matters to the business

NFS clients performing direct I/O can experience sudden kernel crashes, leading to application downtime, data loss risk, and forced reboots on affected systems.

How an attack unfolds

An attacker with network access to an NFSv4 client triggers repeated pNFS layout or write failures (via a controlled or malicious server) while the client issues O_DIRECT writes, causing the kernel function to encounter an unprepared request structure and crash.

How to fix it

Apply the upstream kernel patch resolving the Oops condition in pnfs_mark_request_commit(); update to a maintained kernel branch containing the fix for NFSv4 pNFS O_DIRECT handling.

How to confirm the fix worked

Verify kernel source contains the resolved pnfs_mark_request_commit() logic or confirm running kernel version includes the NFSv4 commit fix; reproduce O_DIRECT write workloads under pNFS failure conditions without triggering oops.

Typical attack path

1. Mount NFSv4 filesystem with pNFS enabled from attacker-controlled server
2. Issue O_DIRECT writes from user space application on client
3. Induce pNFS write or layout failure on server side
4. Kernel attempts commit list rescheduling in pnfs_mark_request_commit()
5. Invalid pointer access triggers oops and system instability

How to detect it

Review kernel logs (dmesg, syslog) for oops/panic entries mentioning pnfs_mark_request_commit or NFS commit list operations coinciding with NFSv4 pNFS write failures; correlate with application O_DIRECT I/O activity.

• pnfs_mark_request_commit
• Oops in pnfs_mark_request_commit
• NFS: failed to reschedule commit after pNFS error

What your security team should do

• Prioritize kernel updates on all NFSv4 clients using pNFS and direct I/O
• Monitor for kernel oops logs referencing pnfs_mark_request_commit during NFS activity
• Temporarily disable pNFS or O_DIRECT where feasible until patched