[PATCH 0/2] NFSD: Fixes for NFSv4 COMPOUND argument teardown

Prabhakar Pujeri reported both of these defects in a single patch:

  https://lore.kernel.org/linux-nfs/20260823113255.3417-1-prabhakar.pujeri-8PEkshWhKlo@public.gmane.org/

They are split here because they need different LTS routing. The
rpc_status dump requires no privilege and is present in a default
build. NFSv4 POSIX ACL support is experimental and disabled by
default, so the ACL-related fix is mainline-only.

In the original proposed fix, the decoder leaves the only reference
to a decoded ACL in the operation's argument structure, and the
executing operation transfers that reference to struct nfsd_attrs.
This is the root cause of leak, so my proposal is to address that
instead.

After close review, I determined that the argp->opcnt assignments
address a problem that is currently unreachable. Instead, my fix
is to block the OOB buffer read during the rpc_status dump.

---
Chuck Lever (2):
      NFSD: Fix out-of-bounds read in the rpc_status dump
      NFSD: Fix POSIX ACL leak in unexecuted NFSv4 COMPOUND operations

 fs/nfsd/nfs4proc.c | 30 ++++++------------------------
 fs/nfsd/nfs4xdr.c  | 41 +++++++++++++++++++++++++++--------------
 fs/nfsd/nfsctl.c   | 21 ++++++++++++++++++---
 fs/nfsd/xdr4.h     |  1 +
 4 files changed, 52 insertions(+), 41 deletions(-)
---
base-commit: 565f77e5882a39bb2b70b9ed580d24e246c49737
change-id: 20260824-nfsd-posix-acl-ownership-3bb3fce46b1c

Best regards,
--  
Chuck Lever