Re: [PATCH v2 0/6] NFSD: Fix UAFs in client teardown and state revocation

On Mon, Jul 6, 2026, at 12:42 PM, Jeff Layton wrote:
> On Sun, 2026-07-05 at 21:25 -0400, Chuck Lever wrote:
>> A NULL-pointer dereference reported during NFSv4 client teardown
>> (patch 1) proved to be one instance of a broader lifetime bug in
>> NFSD's state-revocation machinery. This series fixes the reported
>> crash and the sibling races found by auditing the same pattern, then
>> consolidates the fixes.
>> 
>> A stateid, and a bare lock owner reachable through the client's owner
>> hash, hold only a raw pointer to the owning nfs4_client; a reference
>> on the stateid or owner does not keep the client alive. The client
>> outlives its state solely because __destroy_client() drains that state
>> before free_client() runs. Several paths break that invariant. The
>> laundromat unhashes an expired delegation before revoke_delegation()
>> re-links it, leaving it momentarily on no client-reachable list
>> (patch 2). nfsd4_revoke_states() and its export and NFSv4.0
>> admin-revoke siblings drop nn->client_lock and then dereference the
>> client again (patches 3-5). __destroy_client() walks the owner hash
>> and frees blocked locks with no reference held (patch 1).
>> 
>> ---
>> Changes since v1:
>> - Add matching UAF fixes in several other paths
>> 
>> ---
>> Chuck Lever (6):
>>       NFSD: Prevent lock owner use-after-free during client teardown
>>       NFSD: Prevent client use-after-free during delegation revoke
>>       NFSD: Prevent client use-after-free during admin state revocation
>>       NFSD: Prevent client use-after-free during export state revocation
>>       NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
>>       NFSD: Consolidate the revocation-path client unpin
>> 
>>  fs/nfsd/netns.h     |   6 ++-
>>  fs/nfsd/nfs4state.c | 108 +++++++++++++++++++++++++++++++++++++++++++---------
>>  2 files changed, 94 insertions(+), 20 deletions(-)
>> ---
>> base-commit: ee6ae4a6bf3565b880dfb420017337475dfbc9ea
>> change-id: 20260705-cel-61c1c70caa03
>> 
>> Best regards,
>> --  
>> Chuck Lever
>
> This all looks pretty good, aside from patch #2 which seems like it
> might cause an ABBA deadlock (according to Sashiko).

Reconfirmed that Sashiko's finding was a false positive.


> You can add this to patches 1 and 3-5 though:
>
> Reviewed-by: Jeff Layton <[email protected]>

Thanks!


-- 
Chuck Lever