[PATCH v1 0/2] nfsd: Fix cred refcount leak.

[PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Kuniyuki Iwashima]

get_current_cred() is misused in nfsd_nl_listener_set_doit()
and nfsd_nl_threads_set_doit(), leaking the cred refcount.

Patch 1 & 2 fixes the leak in each function.


Kuniyuki Iwashima (2):
  nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
  nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

 fs/nfsd/nfsctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.52.0.457.g6b5491de43-goog

[PATCH v1 1/2] nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

[Kuniyuki Iwashima]

syzbot reported memory leak of struct cred. [0]

nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.

The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.

The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.

nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.

nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.

Let's use current_cred() in nfsd_nl_threads_set_doit().

[0]:
BUG: memory leak
unreferenced object 0xffff888108b89480 (size 184):
  comm "syz-executor", pid 5994, jiffies 4294943386
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 369454a7):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
    prepare_creds+0x22/0x600 kernel/cred.c:185
    copy_creds+0x44/0x290 kernel/cred.c:286
    copy_process+0x7a7/0x2870 kernel/fork.c:2086
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 924f4fb003ba ("NFSD: convert write_threads to netlink command")
Reported-by: syzbot+dd3b43aa0204089217ee@syzkaller.appspotmail.com
Tested-by: syzbot+dd3b43aa0204089217ee@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69744674.a00a0220.33ccc7.0000.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
 fs/nfsd/nfsctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 084fc517e9e1..ec9782fd4a36 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1642,7 +1642,7 @@ int nfsd_nl_threads_set_doit(struct sk_buff *skb, struct genl_info *info)
 			scope = nla_data(attr);
 	}
 
-	ret = nfsd_svc(nrpools, nthreads, net, get_current_cred(), scope);
+	ret = nfsd_svc(nrpools, nthreads, net, current_cred(), scope);
 	if (ret > 0)
 		ret = 0;
 out_unlock:
-- 
2.52.0.457.g6b5491de43-goog

[PATCH v1 2/2] nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().

[Kuniyuki Iwashima]

nfsd_nl_listener_set_doit() uses get_current_cred() without
put_cred().

As we can see from other callers, svc_xprt_create_from_sa()
does not require the extra refcount.

nfsd_nl_listener_set_doit() is always in the process context,
sendmsg(), and current->cred does not go away.

Let's use current_cred() in nfsd_nl_listener_set_doit().

Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
 fs/nfsd/nfsctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index ec9782fd4a36..85e3bd0e82ba 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1993,7 +1993,7 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
 		}
 
 		ret = svc_xprt_create_from_sa(serv, xcl_name, net, sa, 0,
-					      get_current_cred());
+					      current_cred());
 		/* always save the latest error */
 		if (ret < 0)
 			err = ret;
-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Jeff Layton]

On Sat, 2026-01-24 at 04:18 +0000, Kuniyuki Iwashima wrote:
> get_current_cred() is misused in nfsd_nl_listener_set_doit()
> and nfsd_nl_threads_set_doit(), leaking the cred refcount.
> 
> Patch 1 & 2 fixes the leak in each function.
> 
> 
> Kuniyuki Iwashima (2):
>   nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
>   nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
> 
>  fs/nfsd/nfsctl.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Nice catch.

Reviewed-by: Jeff Layton <jlayton@kernel.org>

Re: [PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Chuck Lever]

From: Chuck Lever <chuck.lever@oracle.com>

On Sat, 24 Jan 2026 04:18:39 +0000, Kuniyuki Iwashima wrote:
> get_current_cred() is misused in nfsd_nl_listener_set_doit()
> and nfsd_nl_threads_set_doit(), leaking the cred refcount.
> 
> Patch 1 & 2 fixes the leak in each function.
> 
> 
> Kuniyuki Iwashima (2):
>   nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
>   nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
> 
> [...]

Applied to nfsd-testing, thanks!

[1/2] nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
      commit: c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
[2/2] nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
      commit: 687b9b69fcda9de606e998fd2edccb8a14406e19

--
Chuck Lever

Re: [PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Kuniyuki Iwashima]

Hi Chuck,

From: Chuck Lever <cel@kernel.org>
Date: Sat, 24 Jan 2026 22:21:05 -0500
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> On Sat, 24 Jan 2026 04:18:39 +0000, Kuniyuki Iwashima wrote:
> > get_current_cred() is misused in nfsd_nl_listener_set_doit()
> > and nfsd_nl_threads_set_doit(), leaking the cred refcount.
> > 
> > Patch 1 & 2 fixes the leak in each function.
> > 
> > 
> > Kuniyuki Iwashima (2):
> >   nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
> >   nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
> > 
> > [...]
> 
> Applied to nfsd-testing, thanks!
> 
> [1/2] nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
>       commit: c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
> [2/2] nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
>       commit: 687b9b69fcda9de606e998fd2edccb8a14406e19

While rebasing my local branch, I just noticed both patches
are not in the mainline and I couldn't find both SHA1 in your
tree.

https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/commit/?id=c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0

Could you double check ?

Thanks !

Re: [PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Chuck Lever]

On Sat, Feb 28, 2026, at 3:01 PM, Kuniyuki Iwashima wrote:
> Hi Chuck,
>
> From: Chuck Lever <cel@kernel.org>
> Date: Sat, 24 Jan 2026 22:21:05 -0500
>> From: Chuck Lever <chuck.lever@oracle.com>
>> 
>> On Sat, 24 Jan 2026 04:18:39 +0000, Kuniyuki Iwashima wrote:
>> > get_current_cred() is misused in nfsd_nl_listener_set_doit()
>> > and nfsd_nl_threads_set_doit(), leaking the cred refcount.
>> > 
>> > Patch 1 & 2 fixes the leak in each function.
>> > 
>> > 
>> > Kuniyuki Iwashima (2):
>> >   nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
>> >   nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
>> > 
>> > [...]
>> 
>> Applied to nfsd-testing, thanks!
>> 
>> [1/2] nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
>>       commit: c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
>> [2/2] nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
>>       commit: 687b9b69fcda9de606e998fd2edccb8a14406e19
>
> While rebasing my local branch, I just noticed both patches
> are not in the mainline and I couldn't find both SHA1 in your
> tree.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/commit/?id=c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
>
> Could you double check ?

The patches are in my nfsd-fixes branch. I'm planning to submit them
soon for 7.0-rc .

-- 
Chuck Lever

Re: [PATCH v1 0/2] nfsd: Fix cred refcount leak.

[Kuniyuki Iwashima]

On Sat, Feb 28, 2026 at 12:37 PM Chuck Lever <cel@kernel.org> wrote:
>
> On Sat, Feb 28, 2026, at 3:01 PM, Kuniyuki Iwashima wrote:
> > Hi Chuck,
> >
> > From: Chuck Lever <cel@kernel.org>
> > Date: Sat, 24 Jan 2026 22:21:05 -0500
> >> From: Chuck Lever <chuck.lever@oracle.com>
> >>
> >> On Sat, 24 Jan 2026 04:18:39 +0000, Kuniyuki Iwashima wrote:
> >> > get_current_cred() is misused in nfsd_nl_listener_set_doit()
> >> > and nfsd_nl_threads_set_doit(), leaking the cred refcount.
> >> >
> >> > Patch 1 & 2 fixes the leak in each function.
> >> >
> >> >
> >> > Kuniyuki Iwashima (2):
> >> >   nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
> >> >   nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
> >> >
> >> > [...]
> >>
> >> Applied to nfsd-testing, thanks!
> >>
> >> [1/2] nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
> >>       commit: c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
> >> [2/2] nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
> >>       commit: 687b9b69fcda9de606e998fd2edccb8a14406e19
> >
> > While rebasing my local branch, I just noticed both patches
> > are not in the mainline and I couldn't find both SHA1 in your
> > tree.
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/commit/?id=c14b0c3b5966a1e2cf6a7f219c4f4b3fafeb89d0
> >
> > Could you double check ?
>
> The patches are in my nfsd-fixes branch. I'm planning to submit them
> soon for 7.0-rc .

Sounds good, sorry for bothering you, and thank you for checking !