Re: [PATCH v3 0/2] lockd: Fix two teardown races in the block retry loop

[Jeff Layton <jlayton@kernel.org>]

On Sat, 2026-08-22 at 21:40 -0400, Chuck Lever wrote:
> nlmsvc_retry_blocked() is the only path that operates on a block with
> nlm_blocked_lock dropped. Both defects live in that window. Shuangpeng
> Bai's KASAN report catches one of them, a block freed while the retry
> is still using it. sashiko-bot flagged the other while reviewing v1.
> The retry re-queues a block that the teardown scan has already
> retired, so the host that block pins is never reaped.
> 
> Patch 1 fixes the first and applies without patch 2, so it can be
> backported on its own. Patch 2 is meant for mainline only. The race
> it closes leaks a host, and closing it widens the f_mutex hold across
> the retry loop.
> 
> v2 added a B_DEAD flag that makes nlmsvc_insert_block() refuse to
> queue a retired block. That appeared to repair the second race, but
> it doesn't work. Every caller relies on that insert to take the list
> reference, so a refused insert lets nlmsvc_grant_blocked() drop the
> last reference to a block whose file_lock the VFS still has queued
> on a blocker.
> 
> Signed-off-by: Chuck Lever <cel@kernel.org>
> 
> ---
> Changes in v3:
> - Split the fix in two. Patch 1 is the block reference alone.
> - Drop B_DEAD. A refused insert could free a live block (sashiko-bot).
> - Serialize the retry against nlmsvc_traverse_blocks() with f_mutex.
> - Link to v2: https://lore.kernel.org/r/20260820150831.3291262-1-cel@kernel.org
> 
> Changes in v2:
> - Add B_DEAD so a retry cannot requeue a retired block (sashiko-bot).
> - Link to v1: https://lore.kernel.org/r/20260819162247.2970703-1-cel@kernel.org
> 
> ---
> Chuck Lever (2):
>       lockd: Fix use-after-free in nlmsvc_retry_blocked
>       lockd: Serialize block retries against host teardown
> 
>  fs/lockd/svclock.c | 33 ++++++++++++++++++++++++++++++---
>  1 file changed, 30 insertions(+), 3 deletions(-)
> ---
> base-commit: 01c2994ccb0197cb44b0db89aacab460110f6347
> change-id: 20260820-lockd-retry-blocked-uaf-68f6b50098d9
> 
> Best regards,
> --  
> Chuck Lever

Reviewed-by: Jeff Layton <jlayton@kernel.org>