Re: [PATCH v1 2/2] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

[Jeff Layton <jlayton@kernel.org>]

On Thu, 2026-02-19 at 16:50 -0500, Chuck Lever wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> The /proc/fs/nfs/exports proc entry is created at module init
> and persists for the module's lifetime. exports_proc_open()
> captures the caller's current network namespace and stores
> its svc_export_cache in seq->private, but takes no reference
> on the namespace. If the namespace is subsequently torn down
> (e.g. container destruction after the opener does setns() to a
> different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
> which frees the cache. Subsequent reads on the still-open fd
> dereference the freed cache_detail, walking a freed hash table.
> 
> Hold a reference on the struct net for the lifetime of the open
> file descriptor. This prevents nfsd_net_exit() from running --
> and thus prevents nfsd_export_shutdown() from freeing the cache
> -- while any exports fd is open. cache_detail already stores
> its net pointer (cd->net, set by cache_create_net()), so
> exports_release() can retrieve it without additional per-file
> storage.
> 
> Reported-by: Misbah Anjum N <misanjum@linux.ibm.com>
> Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/
> Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file")
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
>  fs/nfsd/nfsctl.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 4166f59908f4..3d5a676e1d14 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -149,9 +149,19 @@ static int exports_net_open(struct net *net, struct file *file)
>  
>  	seq = file->private_data;
>  	seq->private = nn->svc_export_cache;
> +	get_net(net);
>  	return 0;
>  }
>  
> +static int exports_release(struct inode *inode, struct file *file)
> +{
> +	struct seq_file *seq = file->private_data;
> +	struct cache_detail *cd = seq->private;
> +
> +	put_net(cd->net);
> +	return seq_release(inode, file);
> +}
> +
>  static int exports_nfsd_open(struct inode *inode, struct file *file)
>  {
>  	return exports_net_open(inode->i_sb->s_fs_info, file);
> @@ -161,7 +171,7 @@ static const struct file_operations exports_nfsd_operations = {
>  	.open		= exports_nfsd_open,
>  	.read		= seq_read,
>  	.llseek		= seq_lseek,
> -	.release	= seq_release,
> +	.release	= exports_release,
>  };
>  
>  static int export_features_show(struct seq_file *m, void *v)
> @@ -1376,7 +1386,7 @@ static const struct proc_ops exports_proc_ops = {
>  	.proc_open	= exports_proc_open,
>  	.proc_read	= seq_read,
>  	.proc_lseek	= seq_lseek,
> -	.proc_release	= seq_release,
> +	.proc_release	= exports_release,
>  };
>  
>  static int create_proc_exports_entry(void)

Reviewed-by: Jeff Layton <jlayton@kernel.org>