Re: [PATCH v2 0/6] NFSD: Fix UAFs in client teardown and state revocation

[Jeff Layton <jlayton@kernel.org>]

On Sun, 2026-07-05 at 21:25 -0400, Chuck Lever wrote:
> A NULL-pointer dereference reported during NFSv4 client teardown
> (patch 1) proved to be one instance of a broader lifetime bug in
> NFSD's state-revocation machinery. This series fixes the reported
> crash and the sibling races found by auditing the same pattern, then
> consolidates the fixes.
> 
> A stateid, and a bare lock owner reachable through the client's owner
> hash, hold only a raw pointer to the owning nfs4_client; a reference
> on the stateid or owner does not keep the client alive. The client
> outlives its state solely because __destroy_client() drains that state
> before free_client() runs. Several paths break that invariant. The
> laundromat unhashes an expired delegation before revoke_delegation()
> re-links it, leaving it momentarily on no client-reachable list
> (patch 2). nfsd4_revoke_states() and its export and NFSv4.0
> admin-revoke siblings drop nn->client_lock and then dereference the
> client again (patches 3-5). __destroy_client() walks the owner hash
> and frees blocked locks with no reference held (patch 1).
> 
> ---
> Changes since v1:
> - Add matching UAF fixes in several other paths
> 
> ---
> Chuck Lever (6):
>       NFSD: Prevent lock owner use-after-free during client teardown
>       NFSD: Prevent client use-after-free during delegation revoke
>       NFSD: Prevent client use-after-free during admin state revocation
>       NFSD: Prevent client use-after-free during export state revocation
>       NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
>       NFSD: Consolidate the revocation-path client unpin
> 
>  fs/nfsd/netns.h     |   6 ++-
>  fs/nfsd/nfs4state.c | 108 +++++++++++++++++++++++++++++++++++++++++++---------
>  2 files changed, 94 insertions(+), 20 deletions(-)
> ---
> base-commit: ee6ae4a6bf3565b880dfb420017337475dfbc9ea
> change-id: 20260705-cel-61c1c70caa03
> 
> Best regards,
> --  
> Chuck Lever

This all looks pretty good, aside from patch #2 which seems like it
might cause an ABBA deadlock (according to Sashiko).

You can add this to patches 1 and 3-5 though:

Reviewed-by: Jeff Layton <jlayton@kernel.org>