Re: [PATCH 0/3] Fix NFSD post-shutdown use-after-free in the unlock_filesystem paths

On Sat, 2026-06-13 at 18:16 -0400, Chuck Lever wrote:
> Musaab Khan reported that a local administrator holding CAP_SYS_ADMIN
> can trigger a use-after-free in nfsd by writing a filesystem path to
> /proc/fs/nfsd/unlock_filesystem after the server has been stopped.
> 
> write_unlock_fs() calls nfsd4_cancel_copy_by_sb() before it takes
> nfsd_mutex and before it confirms that nn->nfsd_serv is set. Once nfsd
> has shut down, nfs4_state_destroy_net() has freed nn->conf_id_hashtbl
> but left the pointer intact, so the cancel helper walks freed slab
> memory as an array of struct list_head and then dereferences a
> bogus nfs4_client when it takes clp->async_lock. KASAN reports a
> slab-use-after-free read in nfsd4_cancel_copy_by_sb().
> 
> nfsd4_revoke_states() walks the same state tables and for that reason
> already runs only under nfsd_mutex with nn->nfsd_serv confirmed
> present. The async COPY cancel was added ahead of that protected
> section, so it escaped the guard. The first two patches move the cancel
> inside the protected section on both the procfs unlock_filesystem path
> and the NFSD_CMD_UNLOCK_FILESYSTEM netlink path. Async copies exist
> only while the server runs, so gating the cancel on nn->nfsd_serv loses
> nothing.
> 
> The netlink command that patch 2 corrects, 327c5168eff2 ("NFSD: Add
> NFSD_CMD_UNLOCK_FILESYSTEM netlink command"), has not yet reached
> mainline; it sits in nfsd-next, destined for v7.2. Patch 2 therefore
> applies to nfsd-next, not to a released kernel, and needs no stable
> backport.
> 
> The last patch adds lockdep_assert_held(&nfsd_mutex) to the state-table
> walkers and documents the nfsd_mutex / nn->nfsd_serv precondition in
> a Context: kdoc section, so a future caller added to this path cannot
> silently reintroduce the same use-after-free.
> 
> ---
> Chuck Lever (3):
>       NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
>       NFSD: Prevent post-shutdown use-after-free in NFSD_CMD_UNLOCK_FILESYSTEM
>       NFSD: Annotate caller preconditions for the state-table walkers
> 
>  fs/nfsd/nfs4proc.c  |  6 ++++++
>  fs/nfsd/nfs4state.c | 16 +++++++++++++++-
>  fs/nfsd/nfsctl.c    | 14 ++++++++------
>  3 files changed, 29 insertions(+), 7 deletions(-)
> ---
> base-commit: 56d6b74e37708005739ef00bb59db34bffac15a8
> change-id: 20260613-unlock-filesystem-uaf-99a7577caea2
> 
> Best regards,
> --  
> Chuck Lever

This all looks good.

Reviewed-by: Jeff Layton <[email protected]>