Re: [PATCH v1] NFSD: Don't start nfsd threads from a pool_threads write

[Jeff Layton <jlayton@kernel.org>]

On Fri, 2026-10-09 at 10:40 -0400, Chuck Lever wrote:
> Writing to pool_threads calls nfsd_set_nrthreads() directly, which
> starts nfsd threads as soon as a svc_serv exists. A portlist write
> creates the svc_serv without running nfsd_startup_net(), so a
> pool_threads write that follows it starts threads in a namespace
> whose NFSv4 state has not been set up. If the server in that
> namespace has been started and shut down before, the hash table
> pointers in struct nfsd_net still point at memory that
> nfs4_state_destroy_net() freed, and the first EXCHANGE_ID those
> threads handle reads it:
> 
>   BUG: KASAN: slab-use-after-free in add_to_unconfirmed
>   nfsd4_exchange_id
>   nfsd4_proc_compound
>   nfsd_dispatch
> 
> A namespace that has never been started dereferences NULL instead.
> 
> write_pool_threads() already starts nothing when no svc_serv exists,
> and its comment documents that only the threads file starts NFS.
> Ignore the thread counts in a pool_threads write while NFSD_NET_UP
> is clear as well, so a pool_threads write never starts threads
> before nfsd_startup_net() has run. The reply still reports the
> current thread count for each pool.
> 
> Fixes: 0a7ec37727dc ("nfsd: make unconf_id_hashtbl allocated per net")
> Reported-by: syzbot+9c7b9c5f6dd1d470b605@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9c7b9c5f6dd1d470b605
> Signed-off-by: Chuck Lever <cel@kernel.org>
> ---
>  fs/nfsd/nfsctl.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 2379b838c028..5a606086b811 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -497,7 +497,8 @@ static ssize_t write_pool_threads(struct file *file, char *buf, size_t size)
>  	if (nthreads == NULL)
>  		goto out_free;
>  
> -	if (size > 0) {
> +	/* Threads started now would run without NFSv4 state. */
> +	if (size > 0 && test_bit(NFSD_NET_UP, &nn->flags)) {
>  		for (i = 0; i < npools; i++) {
>  			rv = get_int(&mesg, &nthreads[i]);
>  			if (rv == -ENOENT)

Reviewed-by: Jeff Layton <jlayton@kernel.org>