From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793210504; b=IRa+FqqFpO2yZeRjmX4R7EtPV+ghdTI0WaCKC5LAlYQz88QRMt2YtYZBA0ZQvRCw649P 1IvwM9SlDc0jvYAY5wEtyHm3faY0AA+QA5l9ZVyPiT39Up1WeGtBjMatPLgLvsA++PRSt IawgsW7E+jgnCrqIAbCMWUQVr6AzQcbWOXG9lcIV01xxK6UO6AAWtWm9OEvHHeJjPzknI KD5BvFW2voVW8lk6N2+8Mk7I5dZNARDMp88weVRcnSB5nW1nFZeGMnaHvIJ6yu9LN8Dak QW5EZT+JNmDlufY3rHvKIabMCQ6CRxpnqsY9oMJAxrqgGmezVDxng5jpZ8Wu0e6Wvow== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793210504; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=+NRqH3cTJwyIslGEYzYYfJ4qdfgcyw+ZGVHhdEBSHvY=; b=qr+tolM9POs53bt+FqaH3FoSN+AE1Nwjxy439xoMAqcjRBpcuNSEEHRXIffQF1AOjk+1 g+mkr0liXUoATdgplQUKzy7AThfQSz+NtYWnQlEk11pM06hXCzbx+hgQgmaubYTsA8ZAj 7vrG9ELHsVrCdj/3f4+XImoebVPo0cHF+YwqqooXvD9Od2Qa9sWDfwyk+9dBfWuDOwvr5 1JtFoDrD6LD1Ue3yajtsdOpqVB0Vc3OUJVmP6k+KJs8OkssarY7Hbm47us11vxCLGEEgq G+1rQH93k5BHG1cVALHMY4OzCyEAzdocB7PCDi+vVnbv+7MyyiVvRlI+DSsuFpcSRww== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=y3GJjWA0; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9E1F606A31A; Wed, 28 Oct 2026 18:01:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=y3GJjWA0 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33AD51F01825; Wed, 28 Oct 2026 18:01:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793210503; bh=+NRqH3cTJwyIslGEYzYYfJ4qdfgcyw+ZGVHhdEBSHvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=y3GJjWA0hn2M1CU0Z0oSR2rGZJr/ziygicKiHkD9OcieP6+ZMYXN+dkh0xwY0vQg1 2h1Fg1FOQKCd4K9vsRT6crfGZ50yjHJqqFvnpaHPsj1x2VH4/xTu988iHsARq06gPg HXGETloe6q2e4Qi1GVIuIpXW9CnNS5cLNw3V9qg0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chris Mason , Chuck Lever , Sasha Levin Subject: [PATCH 5.15 050/571] nfsd: release path refs on follow_down() error Date: Wed, 28 Oct 2026 17:53:17 +0100 Message-ID: <20261028170009.216494038@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170008.009143722@linuxfoundation.org> References: <20261028170008.009143722@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Mason [ Upstream commit 6cba08dc1922140d260cfeb30bbda4ee1bf869d8 ] nfsd_cross_mnt() initializes a local struct path with mntget() and dget() before calling follow_down(). On a negative return the error arm jumps to out without releasing those references: err = follow_down(&path, follow_flags); if (err < 0) goto out; follow_down() never drops the caller's entry-time refs on any error sub-case; for example a pre-cross d_manage() failure leaves path untouched, so the mntget()/dget() taken on entry survive the call. Every other early-exit arm in nfsd_cross_mnt() (other-namespace return, IS_ERR(exp2), and the success tail after the swap) already calls path_put(&path); the err < 0 arm is the lone omission. The leak inflates mnt_count and d_count on each failed cross-mount, blocking umount and pinning dentries against the shrinker, and is reachable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. Fix by calling path_put(&path) before the goto out in the err < 0 arm so the entry-time refs are released on all follow_down() error returns. Fixes: cc53ce53c869 ("Add a dentry op to allow processes to be held during pathwalk transit") Cc: stable@vger.kernel.org Assisted-by: kres:claude-opus-4-7 Signed-off-by: Chris Mason Link: https://patch.msgid.link/20260531-nfsd-testing-v1-2-7bfa481b0540@kernel.org Signed-off-by: Chuck Lever [ retained the older single-argument follow_down(&path) API ] Signed-off-by: Sasha Levin --- fs/nfsd/vfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 7b0bc4507ad04..225916fc0c8d3 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -129,8 +129,10 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp, int err = 0; err = follow_down(&path); - if (err < 0) + if (err < 0) { + path_put(&path); goto out; + } if (path.mnt == exp->ex_path.mnt && path.dentry == dentry && nfsd_mountpoint(dentry, exp) == 2) { /* This is only a mountpoint in some other namespace */ -- 2.53.0