[PATCH v2] nfs/localio: hold auth domain while opening a local filehandle

[Jinpyo Lee <bint4b13@gmail.com>]

nfs_open_local_fh() stabilizes uuid->net under RCU, but uses uuid->dom
after leaving the read-side critical section without holding uuid->lock
or an independent auth-domain reference.

Concurrent LOCALIO invalidation can clear uuid->dom and release the
association's reference before nfsd_open_local_fh() uses the domain.
Generic KASAN reported a four-byte use-after-free write in expkey_init()
when it attempted to acquire a reference through the stale pointer.

Read uuid->dom while holding uuid->lock and take an auth-domain reference
before releasing the lock. Pass the retained domain to NFSD and release
the reference after the server-side open and local-file bookkeeping are
complete.

The reproducer races a LOCALIO open with administrator-driven export and
cache invalidation. It demonstrates the lifetime error, but does not
establish an unprivileged end-to-end trigger. A source reproducer and the
complete KASAN log are available privately on request.

On current nfsd-testing, the unpatched KASAN kernel reproduced the
use-after-free in expkey_init() through nfsd_open_local_fh(). With this
patch applied, the same reproducer could not free the retained auth domain,
and no KASAN report was observed during the patched reproducer run.

The patched kernel also passed basic NFSv4.2 and NFSv3 read, write, and
unmount tests. A full kernel build with GCC 13.3 completed without a new
warning.

The vulnerability research and validation were conducted by members of
the Tobabz team as part of the Best of the Best 15th program.

Fixes: 70ba381e1a43 ("nfs: add LOCALIO support")
Assisted-by: LLM
Signed-off-by: Jinpyo Lee <bint4b13@gmail.com>
---
Changes in v2:
- Regenerate the patch in merge-ready format with the contributor's
  personal identity and DCO sign-off.
- Expand the lifetime analysis and runtime validation description.
- No code changes.

 fs/nfs_common/nfslocalio.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/nfs_common/nfslocalio.c b/fs/nfs_common/nfslocalio.c
index 85aa03a..e0a4273 100644
--- a/fs/nfs_common/nfslocalio.c
+++ b/fs/nfs_common/nfslocalio.c
@@ -269,6 +269,7 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
 		   const fmode_t fmode)
 {
 	struct net *net;
+	struct auth_domain *dom;
 	struct nfsd_file *localio;
 
 	/*
@@ -282,14 +283,19 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
 	 * make 'nfs_to' calls.
 	 */
 	rcu_read_lock();
+	spin_lock(&uuid->lock);
 	net = rcu_dereference(uuid->net);
-	if (!net || !nfs_to->nfsd_net_try_get(net)) {
+	if (!net || !uuid->dom || !nfs_to->nfsd_net_try_get(net)) {
+		spin_unlock(&uuid->lock);
 		rcu_read_unlock();
 		return ERR_PTR(-ENXIO);
 	}
+	dom = uuid->dom;
+	kref_get(&dom->ref);
+	spin_unlock(&uuid->lock);
 	rcu_read_unlock();
 	/* We have an implied reference to net thanks to nfsd_net_try_get */
-	localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt, cred,
+	localio = nfs_to->nfsd_open_local_fh(net, dom, rpc_clnt, cred,
 					     nfs_fh, pnf, fmode);
 	if (!IS_ERR(localio) && nfs_uuid_add_file(uuid, nfl) < 0) {
 		/*
@@ -309,6 +315,7 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
 		nfs_to_nfsd_file_put_local(&tmp);
 		localio = ERR_PTR(-ENXIO);
 	}
+	auth_domain_put(dom);
 	nfs_to_nfsd_net_put(net);
 
 	return localio;
-- 
2.50.1 (Apple Git-155)