Re: [PATCH] Revert "NFSD: Defer sub-object cleanup in export put callbacks"

[yangerkun <yangerkun@huawei.com>]

在 2026/5/12 21:48, Chuck Lever 写道:
> 
> On Mon, May 11, 2026, at 10:33 PM, Yang Erkun wrote:
>> This reverts commit 48db892356d6cb80f6942885545de4a6dd8d2a29.
>>
>> Commit 48db892356d6 ("NFSD: Defer sub-object cleanup in export put
>> callbacks") describes an issue where calling svc_export_put, path_put,
>> and auth_domain_put directly can cause use-after-free (UAF) errors when
>> accessing ex_path or ex_client->name. However, after discussion in [1],
>> it is clear that commit e7fcf179b82d ("NFSD: Hold net reference for the
>> lifetime of /proc/fs/nfs/exports fd") actually resolves this problem.
>>
>> Additionally, commit 48db892356d6 ("NFSD: Defer sub-object cleanup in
>> export put callbacks") introduces a regression that was already fixed by
>> commit 69d803c40ede ("nfsd: Revert "nfsd: release svc_expkey/svc_export
>> with rcu_work""). Therefore, reverting commit 48db892356d6 ("NFSD: Defer
>> sub-object cleanup in export put callbacks") is necessary to fix this
>> regression.
>>
>> Link:
>> https://lore.kernel.org/all/10019b42-4589-4f9f-8d5b-d8197db1ce3c@huawei.com/
>> [1]
>> Fixes: 48db892356d6 ("NFSD: Defer sub-object cleanup in export put
>> callbacks")
>> Signed-off-by: Yang Erkun <yangerkun@huawei.com>
>> ---
>>   fs/nfsd/export.c | 63 +++++++-----------------------------------------
>>   fs/nfsd/export.h |  7 ++----
>>   fs/nfsd/nfsctl.c |  8 +-----
>>   3 files changed, 12 insertions(+), 66 deletions(-)
>>
>> diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
>> index 665153f1720e..0baa58d1dbfc 100644
>> --- a/fs/nfsd/export.c
>> +++ b/fs/nfsd/export.c
>> @@ -36,30 +36,19 @@
>>    * second map contains a reference to the entry in the first map.
>>    */
>>
>> -static struct workqueue_struct *nfsd_export_wq;
>> -
> 
> Hi Erkun -
> 
> This patch doesn't apply to the nfsd-testing branch. What's more,
> the patch series already in flight removes nfsd_export_wq:

Hi Chuck,

Apologies, I initially submitted a patch based on the mainline, but I
will update it to be based on nfsd-testing later.

> 
> https://lore.kernel.org/linux-nfs/98268bb4-2e97-4728-96a6-37b2a4a3ae5d@app.fastmail.com/T/#t
> 
> That patch series replaces the nfsd_export_wq with a WQ that
> is managed in sunrpc.ko. Is that incorrect?
> 
> 

I'm not sure if I understood you correctly. Do you mean that since this
patchset has already removed nfsd_export_wq, I need to adapt more based
on this patchset? Or are you saying that replacing nfsd_export_wq with a
workqueue in sunrpc.ko might not be sufficient because they are two
completely different modules? If you prefer, I can adapt the patch based
on this patchset.

Thanks,
Erkun.