Re: [PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

On 3 Aug 2026, at 5:18, Vasileios Almpanis wrote:

> struct nfs_netns_client embeds two kobjects and is freed by
> nfs_netns_object_release(), the release function of nfs_net_kobj.
> Despite that the first one, p->kobject lives in the same allocation.
> Nothing keeps the allocation from being freed before p->kobject
> has been released.
>
> When CONFIG_DEBUG_KOBJECT_RELEASE=y each release is instead deferred to
> a delayed_work embedded in the kobject, with an independent random
> delay, and nfs_net_kobj frees the allocation first in some of those
> cases. p->kobject's timer is then left armed inside freed memory, and
> the following splat appears:
>
>   [  139.805951][  T131] kobject: 'nfs_client' (ffff888027fdb800): kobject_release, parent 0000000000000000 (delayed 300)
>   [  139.808019][  T131] kobject: 'net' (ffff888027fdb898): kobject_release, parent 0000000000000000 (delayed 100)
>
>   BUG: KASAN: slab-use-after-free in __run_timers+0x932/0x980
>   Write of size 8 at addr ffff888027fdb868 by task swapper/0/0
>
> Reproduced on a KASAN kernel with CONFIG_NFS_FS=y and
> CONFIG_DEBUG_KOBJECT_RELEASE=y by:
>
>   for i in $(seq 16); do unshare -n true; done; sleep 20
>
> Give p->kobject a reference on nfs_net_kobj for its whole lifetime and
> drop it from nfs_netns_client_release(), so the allocation is always
> freed after p->kobject has been released.
>
> Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique")
> Signed-off-by: Vasileios Almpanis <[email protected]>

Reviewed-by: Benjamin Coddington <[email protected]>

Ben