From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48FEC44D686; Tue, 16 Jun 2026 11:59:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781611163; cv=none; b=L44tep0WzSysKZNrH3B/bpOnj7hOttIBSZg4SjqisL/4pVOwjOmczbjUdAtUZNIJQr5arNm+t2uTG0yVrDbdlxccyEpZCEwrPOufCCbySoLqgfDMvoWnKhJ//TgZIj+TozoFN8YYC+e4rabUmzSo5ObxJ1lll+jKXQVH6TWxV8E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781611163; c=relaxed/simple; bh=yujvtKgV+rrqTxGZiIZdFtl5KKnMCHL0FrhYvZXBa54=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KvkjlpAE09WpK+KNE3H/nUhDhudxJsx8JsBR6s9dGnF/K4dfD+o3Sk84iD0xMMJL1Fep8yGB+tIxLfrsh1me9RAx4t3sJvh72ib3KHomMBtwtpI4fznxHPp4X3NXPl3xdFxXgS/JHl/evk7QJ2+/LH3tMHVVuKyU9xQyKEsQsZ8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RasIJLbh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RasIJLbh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 476971F000E9; Tue, 16 Jun 2026 11:59:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781611161; bh=H+wj7DCmSt7OaZ4FtIq8F3+5YRkG+bzV1wG+Jk6zed4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=RasIJLbhdNkejEsvlDX6F0YtvAMirjsJM7l4ZChHfz7TSeTQS8EOOIxLzotPeFJnt 49L3jNtOLGgGG3da4O5a26LQ1xITsH26iwoeUHGvICf8bCp8vnaquXWJ9FShKzumfK 3DcW9fvJt8CiZlzAA2Dio7n6mUMq7f5yYkIABSuWmAWS2wMQNr9u6/odB3FJMzXT9k txRd8K35IUwKZ+rGNW7Ie6ZvXooL5+O5qyA88jvxCfpOJCgDINjpH5NF9HsHM3NObC NTh9teSzumUoTKunZGxaSjCP1KIo3n7qOXkapiWHanxpc+gJrpFmo+R374nLgU2T6G MKX8oQ6rTt5YA== From: Jeff Layton Date: Tue, 16 Jun 2026 07:58:51 -0400 Subject: [PATCH v7 08/20] nfsd: use RCU to protect fi_deleg_file Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260616-dir-deleg-v7-8-6cbc7eac0ade@kernel.org> References: <20260616-dir-deleg-v7-0-6cbc7eac0ade@kernel.org> In-Reply-To: <20260616-dir-deleg-v7-0-6cbc7eac0ade@kernel.org> To: NeilBrown , Olga Kornievskaia , Dai Ngo , Tom Talpey , Trond Myklebust , Anna Schumaker , Jonathan Corbet , Shuah Khan , Chuck Lever Cc: Steven Rostedt , Alexander Aring , Amir Goldstein , Jan Kara , Alexander Viro , Christian Brauner , Calum Mackay , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-nfs@vger.kernel.org, Jeff Layton X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=9329; i=jlayton@kernel.org; h=from:subject:message-id; bh=yujvtKgV+rrqTxGZiIZdFtl5KKnMCHL0FrhYvZXBa54=; b=owEBbQKS/ZANAwAKAQAOaEEZVoIVAcsmYgBqMTqF2s5pldhTdQMfAiWdzRGxNNrJlZIZpR6fi 3lNAAc5OXWJAjMEAAEKAB0WIQRLwNeyRHGyoYTq9dMADmhBGVaCFQUCajE6hQAKCRAADmhBGVaC FUEVEADQ3yNxqfWPHCCnUwIYebk727VrglX7YC6rTpUGUXsGsqzTIQWHyFHlJUo5zlFeDfURm/P HSsoNa1tag3pl8qW/kS1c7HyKz710xECRqBNdrljK0LyEbEwm/eylU3kYgnTdcr1bc/k30LNRNW RDeRtzsaDEaF1XSWsyDnE3QIE+lSdmvsWT4e7G/4QxLthO9UcAvKbc9ECsFB2W+teCbj3G3VfAX ybOIKISus6HGBp42crWHfN5+EeZzIY5AgstjRP0/8TnHI//b1VG5MuqP/10K+54g8sShoghWe/O y5nG5nkD4/jHNvuG9nLUlePvusfMpsknAj8sePPEWmPHk1rvBKBjPiEKMnu4OdxsClTCbM9GjZF Gt//GIaje4Fz/qhW2i/CP8bI1hULgn9NyLQIB6u26IHVQdkVBFgZv5oOzaFG3zkChzW7BA94Syi fz8USzpLSikI/q8uLsoSC+TqXP9T34MmgiVyMZnP3nHBt8eQFjB4wQvGvHkCmUbTiDsUwLryGgq cCw1+cFmvb6z3humVihz3cytY6sk0lkwP0/OyoT7djqfmdt2c6w/SF0/B8c5kD+Elt6Pgp1Ejlj VfuEZUiFAaVfA/Ew16KHuxS3vglTDfHAT1TQMP8tYDvqIFCa7twZni65jv1jRguPt3ggKNtsT5D 60Hiq0fbMZBh/NA== X-Developer-Key: i=jlayton@kernel.org; a=openpgp; fpr=4BC0D7B24471B2A184EAF5D3000E684119568215 fi_deleg_file can be NULLed by put_deleg_file() when fi_delegees drops to zero during delegation teardown (e.g. DELEGRETURN). Concurrent accesses from workqueue callbacks -- such as CB_NOTIFY -- can dereference a NULL pointer if they race with this teardown. Annotate fi_deleg_file with __rcu and convert all accessors to use proper RCU primitives: - rcu_assign_pointer() / RCU_INIT_POINTER() for stores - rcu_dereference_protected() for reads under fi_lock or where fi_delegees > 0 guarantees stability This prepares for a subsequent patch that will use rcu_read_lock + rcu_dereference + nfsd_file_get to safely acquire a reference from the CB_NOTIFY callback path without holding fi_lock. While converting the error-path lease teardown in nfsd_get_dir_deleg(), also add a nfsd_fsnotify_recalc_mask() call after dropping the lease, to match the success path and the equivalent teardown in nfs4_unlock_deleg_lease(). Without it, a failure after the lease is set leaves the inode's fsnotify mask reflecting a delegation that no longer exists. That teardown already unlocks against fi_deleg_file->nf_file rather than this client's nf->nf_file; document why. The lease's flc_file is set to fi_deleg_file in nfs4_alloc_init_lease(), which differs from nf when an earlier client already holds a delegation on the same directory, and generic_delete_lease() matches on flc_file -- unlocking the wrong file would leak the lease on the inode. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton --- fs/nfsd/nfs4layouts.c | 7 ++++--- fs/nfsd/nfs4state.c | 51 ++++++++++++++++++++++++++++++++++----------------- fs/nfsd/state.h | 2 +- 3 files changed, 39 insertions(+), 21 deletions(-) diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c index 4c3f253c7d07..22bcb6d09f70 100644 --- a/fs/nfsd/nfs4layouts.c +++ b/fs/nfsd/nfs4layouts.c @@ -248,12 +248,13 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, NFSPROC4_CLNT_CB_LAYOUT); if (parent->sc_type == SC_TYPE_DELEG) { - spin_lock(&fp->fi_lock); - ls->ls_file = nfsd_file_get(fp->fi_deleg_file); - spin_unlock(&fp->fi_lock); + rcu_read_lock(); + ls->ls_file = nfsd_file_get(rcu_dereference(fp->fi_deleg_file)); + rcu_read_unlock(); } else { ls->ls_file = find_any_file(fp); } + if (!ls->ls_file) { nfs4_put_stid(stp); return NULL; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 2189d8d360af..47af5729a86f 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1212,7 +1212,9 @@ static void put_deleg_file(struct nfs4_file *fp) spin_lock(&fp->fi_lock); if (--fp->fi_delegees == 0) { - swap(nf, fp->fi_deleg_file); + nf = rcu_dereference_protected(fp->fi_deleg_file, + lockdep_is_held(&fp->fi_lock)); + RCU_INIT_POINTER(fp->fi_deleg_file, NULL); swap(rnf, fp->fi_rdeleg_file); } spin_unlock(&fp->fi_lock); @@ -1250,7 +1252,7 @@ static void nfsd4_finalize_deleg_timestamps(struct nfs4_delegation *dp, struct f static void nfs4_unlock_deleg_lease(struct nfs4_delegation *dp) { struct nfs4_file *fp = dp->dl_stid.sc_file; - struct nfsd_file *nf = fp->fi_deleg_file; + struct nfsd_file *nf = rcu_dereference_protected(fp->fi_deleg_file, 1); WARN_ON_ONCE(!fp->fi_delegees); @@ -3200,7 +3202,8 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st) /* XXX: lease time, whether it's being recalled. */ spin_lock(&nf->fi_lock); - file = nf->fi_deleg_file; + file = rcu_dereference_protected(nf->fi_deleg_file, + lockdep_is_held(&nf->fi_lock)); if (file) { seq_puts(s, ", "); nfs4_show_superblock(s, file); @@ -5009,7 +5012,7 @@ static void nfsd4_file_init(const struct svc_fh *fh, struct nfs4_file *fp) INIT_LIST_HEAD(&fp->fi_delegations); INIT_LIST_HEAD(&fp->fi_clnt_odstate); fh_copy_shallow(&fp->fi_fhandle, &fh->fh_handle); - fp->fi_deleg_file = NULL; + RCU_INIT_POINTER(fp->fi_deleg_file, NULL); fp->fi_rdeleg_file = NULL; fp->fi_had_conflict = false; fp->fi_share_deny = 0; @@ -6163,7 +6166,7 @@ static struct file_lease *nfs4_alloc_init_lease(struct nfs4_delegation *dp, u32 fl->c.flc_type = deleg_is_read(dp->dl_type) ? F_RDLCK : F_WRLCK; fl->c.flc_owner = (fl_owner_t)dp; fl->c.flc_pid = current->tgid; - fl->c.flc_file = dp->dl_stid.sc_file->fi_deleg_file->nf_file; + fl->c.flc_file = rcu_dereference_protected(dp->dl_stid.sc_file->fi_deleg_file, 1)->nf_file; return fl; } @@ -6171,7 +6174,7 @@ static int nfsd4_check_conflicting_opens(struct nfs4_client *clp, struct nfs4_file *fp) { struct nfs4_ol_stateid *st; - struct file *f = fp->fi_deleg_file->nf_file; + struct file *f = rcu_dereference_protected(fp->fi_deleg_file, 1)->nf_file; struct inode *ino = file_inode(f); int writes; @@ -6248,7 +6251,7 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp, exp_put(exp); dput(child); - if (child != file_dentry(fp->fi_deleg_file->nf_file)) + if (child != file_dentry(rcu_dereference_protected(fp->fi_deleg_file, 1)->nf_file)) return -EAGAIN; return 0; @@ -6354,8 +6357,9 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, status = -EAGAIN; else if (nfsd4_verify_setuid_write(open, nf)) status = -EAGAIN; - else if (!fp->fi_deleg_file) { - fp->fi_deleg_file = nf; + else if (!rcu_dereference_protected(fp->fi_deleg_file, + lockdep_is_held(&fp->fi_lock))) { + rcu_assign_pointer(fp->fi_deleg_file, nf); /* increment early to prevent fi_deleg_file from being * cleared */ fp->fi_delegees = 1; @@ -6380,7 +6384,7 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, if (!fl) goto out_clnt_odstate; - status = kernel_setlease(fp->fi_deleg_file->nf_file, + status = kernel_setlease(rcu_dereference_protected(fp->fi_deleg_file, 1)->nf_file, fl->c.flc_type, &fl, NULL); if (fl) locks_free_lease(fl); @@ -6401,7 +6405,7 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, * Now that the deleg is set, check again to ensure that nothing * raced in and changed the mode while we weren't looking. */ - status = nfsd4_verify_setuid_write(open, fp->fi_deleg_file); + status = nfsd4_verify_setuid_write(open, rcu_dereference_protected(fp->fi_deleg_file, 1)); if (status) goto out_unlock; @@ -6422,7 +6426,8 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, return dp; out_unlock: - kernel_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp); + kernel_setlease(rcu_dereference_protected(fp->fi_deleg_file, 1)->nf_file, + F_UNLCK, NULL, (void **)&dp); out_clnt_odstate: put_clnt_odstate(dp->dl_clnt_odstate); nfs4_put_stid(&dp->dl_stid); @@ -6579,8 +6584,9 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open, memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid)); if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE) { - struct file *f = dp->dl_stid.sc_file->fi_deleg_file->nf_file; + struct file *f; + f = rcu_dereference_protected(dp->dl_stid.sc_file->fi_deleg_file, 1)->nf_file; if (!nfsd4_add_rdaccess_to_wrdeleg(rqstp, open, fh, stp) || !nfs4_delegation_stat(dp, currentfh, &stat)) { nfs4_put_stid(&dp->dl_stid); @@ -9787,8 +9793,9 @@ nfsd_get_dir_deleg(struct nfsd4_compound_state *cstate, /* existing delegation? */ if (nfs4_delegation_exists(clp, fp)) { status = -EAGAIN; - } else if (!fp->fi_deleg_file) { - fp->fi_deleg_file = nfsd_file_get(nf); + } else if (!rcu_dereference_protected(fp->fi_deleg_file, + lockdep_is_held(&fp->fi_lock))) { + rcu_assign_pointer(fp->fi_deleg_file, nfsd_file_get(nf)); fp->fi_delegees = 1; } else { ++fp->fi_delegees; @@ -9844,8 +9851,18 @@ nfsd_get_dir_deleg(struct nfsd4_compound_state *cstate, return dp; } - /* Something failed. Drop the lease and clean up the stid */ - kernel_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp); + /* + * Something failed after the lease was set. Drop the lease and clean + * up the stid. The lease's flc_file is the fi_deleg_file (see + * nfs4_alloc_init_lease()), which is not necessarily this client's + * @nf when an earlier client already holds a delegation on @fp. + * generic_delete_lease() matches on flc_file, so unlock against + * fi_deleg_file or the lease will be leaked (and later freed with the + * stid, leading to a use-after-free when it's eventually broken). + */ + kernel_setlease(rcu_dereference_protected(fp->fi_deleg_file, 1)->nf_file, + F_UNLCK, NULL, (void **)&dp); + nfsd_fsnotify_recalc_mask(nf); out_put_stid: nfs4_put_stid(&dp->dl_stid); out_delegees: diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 9f321e9ed76d..4fca0537ca8b 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -699,7 +699,7 @@ struct nfs4_file { */ atomic_t fi_access[2]; u32 fi_share_deny; - struct nfsd_file *fi_deleg_file; + struct nfsd_file __rcu *fi_deleg_file; struct nfsd_file *fi_rdeleg_file; int fi_delegees; struct knfsd_fh fi_fhandle; -- 2.54.0