[PATCH v1] NFSD: Don't start nfsd threads from a pool_threads write

[Chuck Lever <cel@kernel.org>]

Writing to pool_threads calls nfsd_set_nrthreads() directly, which
starts nfsd threads as soon as a svc_serv exists. A portlist write
creates the svc_serv without running nfsd_startup_net(), so a
pool_threads write that follows it starts threads in a namespace
whose NFSv4 state has not been set up. If the server in that
namespace has been started and shut down before, the hash table
pointers in struct nfsd_net still point at memory that
nfs4_state_destroy_net() freed, and the first EXCHANGE_ID those
threads handle reads it:

  BUG: KASAN: slab-use-after-free in add_to_unconfirmed
  nfsd4_exchange_id
  nfsd4_proc_compound
  nfsd_dispatch

A namespace that has never been started dereferences NULL instead.

write_pool_threads() already starts nothing when no svc_serv exists,
and its comment documents that only the threads file starts NFS.
Ignore the thread counts in a pool_threads write while NFSD_NET_UP
is clear as well, so a pool_threads write never starts threads
before nfsd_startup_net() has run. The reply still reports the
current thread count for each pool.

Fixes: 0a7ec37727dc ("nfsd: make unconf_id_hashtbl allocated per net")
Reported-by: syzbot+9c7b9c5f6dd1d470b605@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9c7b9c5f6dd1d470b605
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 fs/nfsd/nfsctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 2379b838c028..5a606086b811 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -497,7 +497,8 @@ static ssize_t write_pool_threads(struct file *file, char *buf, size_t size)
 	if (nthreads == NULL)
 		goto out_free;
 
-	if (size > 0) {
+	/* Threads started now would run without NFSv4 state. */
+	if (size > 0 && test_bit(NFSD_NET_UP, &nn->flags)) {
 		for (i = 0; i < npools; i++) {
 			rv = get_int(&mesg, &nthreads[i]);
 			if (rv == -ENOENT)
-- 
2.54.0