Re: [PATCH 1/3] NFSD: Prevent post-shutdown use-after-free in unlock_filesystem

On Sun, Jun 21, 2026 at 07:07:47PM +0800, XIAO WU wrote:
> I was able to trigger it in QEMU with KASAN: creating an NFSD listener
> via portlist sets `nn->nfsd_serv`, but without starting any threads,
> `nfsd_startup_net()` never runs.  Writing to unlock_filesystem then
> calls `nfsd4_cancel_copy_by_sb()` which dereferences the uninitialized
> `nfs4_client` hashtable -> NULL pointer dereference. 
  
Thanks for the careful analysis and the reproducer. I agree the crash
is real. nfsd_create_serv() sets nn->nfsd_serv from the portlist and
netlink listener paths, none of which run nfsd_startup_net(), so
nn->nfsd_serv can indeed be non-NULL while the NFSv4 state tables are
still NULL.
  
One correction: the array the walk dereferences is nn->conf_id_hashtbl,
not nn->nfs4_client_hashtbl. Both are allocated together in
nfs4_state_create_net(), reached only via nfsd_startup_net(), so your
mechanism holds either way; the name in the report is just off.
  
However, this crasher is a different bug from the one this series
addresses, and AFAICT it is not introduced by this patch. Before this
change the cancel ran unconditionally, so the same NULL conf_id_hashtbl
walk was reachable in the startup window (and more besides). The
nn->nfsd_serv guard added here narrows the post-shutdown case but does
not cover the startup window, because nn->nfsd_serv is set before the
tables exist. The two also differ at KASAN: this patch fixes a
slab-use-after-free on a freed-but-not-cleared conf_id_hashtbl; what
you hit is a null-ptr-deref on a never-allocated one.

The correct guard for the startup window is NFSD_NET_UP, which is set
at the tail of nfsd_startup_net() exactly when the state tables become 
valid, rather than nn->nfsd_serv. nfsd4_revoke_states() walks the same
tables and nfsd_nl_unlock_filesystem_doit() repeats the pattern, so a
fix needs to cover both unlock paths. I'll address that in a separate
follow-up and add your Reported-by.

-- 
Chuck Lever