[PATCH] NFS: Destroy callback transports on initialization failure

[PATCH] NFS: Destroy callback transports on initialization failure

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

During NFSv4 callback initialization, the IPv4 listener is created
successfully, but the IPv6 listener fails to start. The error path
returns without cleaning up the IPv4 listener. As a result, the
transport remains attached to serv->sv_permsocks, causing svc_destroy()
to trigger a warning.

Call svc_xprt_destroy_all() when IPv6 listener creation fails to
close any transports that were already created. This ensures all
transports are cleaned up before the service is destroyed.

Reported-by: syzbot+8cbdf9aa6c281a4e6bbe@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6aee17c4.8be4ead1.3b45e1.0199.GAE@google.com/T/
Fixes: c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()")
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
Note: Tested by syzbot using the reproducer. The kernel built successfully,
and the original WARNING was no longer reproduced.
---
 fs/nfs/callback.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index bc282b744f34..29134e2c56cd 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -61,9 +61,11 @@ static int nfs4_callback_up_net(struct svc_serv *serv, struct net *net)
 		dprintk("NFS: Callback listener port = %u (af %u, net %x)\n",
 			nn->nfs_callback_tcpport6, PF_INET6, net->ns.inum);
 	} else if (ret != -EAFNOSUPPORT)
-		goto out_err;
+		goto out_destroy_xprts;
 	return 0;
 
+out_destroy_xprts:
+	svc_xprt_destroy_all(serv, net, false);
 out_err:
 	return (ret) ? ret : -ENOMEM;
 }
-- 
2.43.0

Re: [PATCH] NFS: Destroy callback transports on initialization failure

[Yalagada Pavan Kumar]

On Mon, Nov 09, 2026 at 02:34:52AM +0530, pavankumaryalagada@gmail.com wrote:
> From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
> 
> During NFSv4 callback initialization, the IPv4 listener is created
> successfully, but the IPv6 listener fails to start. The error path
> returns without cleaning up the IPv4 listener. As a result, the
> transport remains attached to serv->sv_permsocks, causing svc_destroy()
> to trigger a warning.
> 
> Call svc_xprt_destroy_all() when IPv6 listener creation fails to
> close any transports that were already created. This ensures all
> transports are cleaned up before the service is destroyed.
> 
> Reported-by: syzbot+8cbdf9aa6c281a4e6bbe@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/all/6aee17c4.8be4ead1.3b45e1.0199.GAE@google.com/T/
> Fixes: c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()")
> Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
> ---
> Note: Tested by syzbot using the reproducer. The kernel built successfully,
> and the original WARNING was no longer reproduced.
> ---
>  fs/nfs/callback.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
> index bc282b744f34..29134e2c56cd 100644
> --- a/fs/nfs/callback.c
> +++ b/fs/nfs/callback.c
> @@ -61,9 +61,11 @@ static int nfs4_callback_up_net(struct svc_serv *serv, struct net *net)
>  		dprintk("NFS: Callback listener port = %u (af %u, net %x)\n",
>  			nn->nfs_callback_tcpport6, PF_INET6, net->ns.inum);
>  	} else if (ret != -EAFNOSUPPORT)
> -		goto out_err;
> +		goto out_destroy_xprts;
>  	return 0;
>  
> +out_destroy_xprts:
> +	svc_xprt_destroy_all(serv, net, false);

Hi,

Could you please review this when you have a moment?

Thanks,
Pavan

>  out_err:
>  	return (ret) ? ret : -ENOMEM;
>  }
> -- 
> 2.43.0
>