Re: [PATCH] nfsd: release POSIX ACLs of unexecuted compound ops

On Sun, Aug 23, 2026, at 7:32 AM, [email protected] wrote:
> From: Prabhakar Pujeri <[email protected]>
>
> nfsd4_decode_fattr4() allocates POSIX ACLs while decoding OP_OPEN,
> OP_CREATE, and OP_SETATTR. Normally a processed OPEN releases them from
> its op_release callback, while CREATE and SETATTR transfer ownership to
> struct nfsd_attrs and clear their pointers.
>
> If compound processing stops before a decoded ACL-bearing operation,
> nfsd4_release_compoundargs() frees the operation array without dropping
> those ACL references. A client can repeat an aborting compound to leak
> server memory.
>
> Release ACLs that remain attached to decoded operations when the
> compound arguments are destroyed. Clear the OPEN pointers in its release
> callback so the final sweep remains idempotent for processed operations;
> CREATE and SETATTR already clear theirs when transferring ownership.
>
> The procedure release callback also runs after a hard XDR decode failure.
> Keep opcnt limited to fully initialized entries on a truncated operation
> number, and clear it when the dynamic operation array cannot be
> allocated, so cleanup never walks stale inline entries or beyond the
> inline array.
>
> An A/B kmemleak test with 512 crafted NFSv4.2 compounds found 347--349
> leaked 64-byte ACL objects without this change and none with it. On the
> rebased kernel, 512 runtime-abort and 512 hard-decode compounds completed
> without a kmemleak or KASAN report.
>
> Fixes: 5fc51dfc2eb1 ("NFSD: Add support for XDR decoding POSIX draft ACLs")
> Signed-off-by: Prabhakar Pujeri <[email protected]>

Hi Prabhakar,

Thanks for the report. I agree with the diagnosis and its status as
triggerable by a remote. After careful review, I have decided to
split the work into two patches.

Your two opcnt assignments fix something separate from the ACL leak,
and that fix needs to be backported to stable kernels.

For the ACL half, the underlying issue is that ->set_acl() borrows
the caller's reference rather than consuming it. That makes pointer
ownership the true root cause, which IMHO needs a different approach
than your proposed fix. And, since POSIX ACLs in NFSv4 are
experimental and disabled by default, it's something that can be
treated as mainline-only; no backport.

I'll post these as a two-patch series soon for you to review and try
out.

Can you share the test that generated the 512 crafted compounds?


-- 
Chuck Lever