[PATCH v3] nfsd: fix use-after-free of DRC slot in nfsd4_sequence()

[Tien Phan <tienpp@gmail.com>]

nfsd4_sequence() loads the slot for the client-supplied seq->slotid
(bounded only by se_fchannel.maxreqs), then on the reduce-ack path frees
every slot in [se_target_maxslots, maxreqs) with free_session_slots()
without checking that the loaded slot is outside that range.

Once the DRC shrinker has lowered se_target_maxslots below maxreqs, a
client using seq->slotid >= se_target_maxslots has its own slot freed and
then dereferenced and written (slot->sl_seqid, cstate->slot): a
use-after-free.

Reject such a slotid before freeing the slots.

Fixes: fc8738c68d0b ("nfsd: add support for freeing unused session-DRC slots")
Cc: stable@vger.kernel.org # 6.14+
Reported-by: Sentinel (automated analysis agent)
Assisted-by: Claude (Anthropic)
Signed-off-by: Tien Phan <tienpp@gmail.com>
---
v3: trim commit message; drop the added in-code comment (Greg KH).
v2: add Reported-by:/Assisted-by: trailers (Greg KH); fix NeilBrown address.
v1: https://lore.kernel.org/all/20260819054326.1265334-1-tienpp@gmail.com/
 fs/nfsd/nfs4state.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index a42f34842d77..def1ea534e18 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4575,9 +4575,14 @@ nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
 	if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
 	    slot->sl_generation == session->se_slot_gen &&
-	    seq->maxslots <= session->se_target_maxslots)
+	    seq->maxslots <= session->se_target_maxslots) {
 		/* Client acknowledged our reduce maxreqs */
+		if (seq->slotid >= session->se_target_maxslots) {
+			status = nfserr_badslot;
+			goto out_put_session;
+		}
 		free_session_slots(session, session->se_target_maxslots);
+	}
 
 	buflen = (seq->cachethis) ?
 			session->se_fchannel.maxresp_cached :
-- 
2.34.1