Re: [PATCH 1/2] NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Hi Anna,

On Fri, Jul 10, 2026 at 08:47:14PM +0000, Anna Schumaker wrote:
> Dan Aloni reports that he was able to hit a use-after-free bug if a
> FREE_STATEID operation gets delayed for whatever reason. Fix this by
> bumping the refcount of the 'struct nfs_server' object for the duration
> of the FREE_STATEID so it doesn't get cleaned up from underneath us
> while operations are still in flight.

This patch reminded me of a similar nfs_server use-after-free that we
recently encountered in production. However, it appears to involve a
different race and root cause:

  NFSv4: pin the superblock for active state owners
  https://lore.kernel.org/all/20260707133623.23078-1-zhujia.zj-EC8Uxl6Npydl57MIdRCFDg@public.gmane.org/

Would you mind taking a look at it and letting me know if the approach
looks reasonable?

Thanks,
Jia