Re: [PATCH] nfsd: fix race between client_info_show() and free_client()

On Sun, 26 Jul 2026 17:46:58 +0500, Ameer Hamza wrote:
> client_info_show() renders /proc/fs/nfsd/clients/<id>/info and walks
> clp->cl_sessions under clp->cl_lock to print each session's slot
> counts.  free_client() tears down the same list without taking
> cl_lock, and is the only unlocked mutator of cl_sessions.  A reader
> can observe a client mid-teardown because get_nfsdfs_clp() pins the
> nfs4_client but not its sessions: free_client() frees every session
> before calling nfsd_client_rmdir(), so an in-flight seq_file reader
> can follow a list_del()'d node whose ->next now holds LIST_POISON1
> and take a general protection fault:
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: fix race between client_info_show() and free_client()
      commit: fe521a9894e7ffed2a2eda9383622d4533ad655f

--
Chuck Lever