From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8A5A3B42CE; Thu, 9 Jul 2026 18:47:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783622875; cv=none; b=NH+eSx6/QLanWgLjq/W1Pa/BXYTVK3E0NBBUFjNXHJRDWPaU4lxSDdSOdIjmST7Y7CeKNp0voLm859URwJ1DD7FLLbxve+bnuAutu94Ba4tOQewMtPlljrNy1CqtjrcDWbLFeC0ppcvCb0Tt9NE3OBFcxp9jr3y/CJC6XufygBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783622875; c=relaxed/simple; bh=Sz2LMgcQvHwgc5A6WpVLpFF7304tQx5qcH4SiERKf9U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=W5dE6U+AyFjILyxvVCDyP315HG+FINWu5GmKkg4sgDk5qDaX3X4Bbfb7L1Dp+naGujTo4oyvGmTaylDDPewdb2xODA31zBEqgaJq5U1wKWRvCZnRob/aW0ihWGZbGFtXh6Enkz7Ae/JO24GR7QrGps59NzPZEGAtZTPACO20vyw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OBzdGi/U; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OBzdGi/U" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEEFD1F000E9; Thu, 9 Jul 2026 18:47:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783622874; bh=82/w5SBRaBkM2WwnNYQrjw8sXLjbyUS55lx23z+zi6g=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OBzdGi/UvlvWy/XC25dlTql5oLdxfWmXUEbXOQnrEptobUd7y3WBCyLpq3FkziWi8 jic7NQ1bpSmIO3NepRUJEk+omVckn0lvgCRaVoB/V78Iu8fdmU+PqhLwro0G8ZSIS0 x8JTq5OEaATVjCOSYJ5neqvUbnrll+XJHHWVjxCoHmdhebDSLb55U6kgm9Nimo7hcv /b4Dw2DgcX89zQ4KWRCF/svlvwqre3NqsK6e8uP1TwyaoFZVHzWxYYzi8wdSkUjyqx +low9ql3Rha5ZZ27AcX+ienkEUtzFFCXE3sqk6cweF9bvwOrEBTffkeWiblzqs6oaI VPj7cxaBIpPnQ== From: Jeff Layton Date: Thu, 09 Jul 2026 14:47:40 -0400 Subject: [PATCH v2 03/10] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260709-nfsd-testing-v2-3-0a1ba233bf87@kernel.org> References: <20260709-nfsd-testing-v2-0-0a1ba233bf87@kernel.org> In-Reply-To: <20260709-nfsd-testing-v2-0-0a1ba233bf87@kernel.org> To: Chuck Lever , NeilBrown , Olga Kornievskaia , Dai Ngo , Tom Talpey , Andy Adamson Cc: Chris Mason , linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, Jeff Layton X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2386; i=jlayton@kernel.org; h=from:subject:message-id; bh=Sz2LMgcQvHwgc5A6WpVLpFF7304tQx5qcH4SiERKf9U=; b=owEBbQKS/ZANAwAKAQAOaEEZVoIVAcsmYgBqT+zUi6fIz2nr+XsZOi7bWTkGQOWAiUmLc8qwP 11sCviKP0+JAjMEAAEKAB0WIQRLwNeyRHGyoYTq9dMADmhBGVaCFQUCak/s1AAKCRAADmhBGVaC FVtTD/9sUBXHSbz0HVAYBtj0C6rv1+w5l4Qik6fxuVI0vZOsT/jt+sM7HTdMZ9oa6ZSh0GL0lIu EnXL/I8NLERAb5stbbGRNSIlxojkMhBoqtinftcFatVvKmI1+qC34eOZrZeOd/1h8kM+ILauGTW /h0463/KVDmNRE+fGVqIUhrrV1LQ+IXGXzzZrQ+OiEqinJz4dy0fs7lsruZGjKPuZYN81qDTUDt 3JbOCK4u9qTxvkkl2rSuydQcEPQM8GCYMGElD74cIA8/sqtx3MRYL/hHXOroWg73VPVcpIgDOI5 hjbl0PDjhrYhG9/dziJGvK6FqkQ3nIgUvRNmSdQf5IZojZo0pZ6WSJ9LxuFB05c+7pQLOlGKDHO oMACWzYJL6ECwGzDKNF50ENerBNtqk6LpUVZCn1yxLPySNOY5jA/e6IcEsY4bxP3stGdnLQw3nc hOHnS64YixHhjxx50FeuXq8Agp2nrlaumbt7l1WjMUWUuqG7bhO36aUZTRMY6QxDXGTkoxyc60T yrrH+HVj6dY71BypU9kk7SjUHDAl8QiW0bjul0DZq2MXbQCRj4339X3jFSottxtZU6MiZvRShFB /snwlmgO6QE4zB4XzjVvXN86Eu3gswqIxffstKHMR7kJW5SDG1W9+dSXvvUC4aYEjOAxrCuR5JC s9SHnX6FAtTKgag== X-Developer-Key: i=jlayton@kernel.org; a=openpgp; fpr=4BC0D7B24471B2A184EAF5D3000E684119568215 For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is reused by the next request. dup_copy_fields() copies only the value into async_copy, so the IDR slot dangled at the transient buffer for the whole background copy. Any IDR walker then dereferences reused request memory: the laundromat reads cs_type from it and, if the bytes look like an expired NFS4_COPYNOTIFY_STID, follows into refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has the same exposure via idr_find(). Duplicate the fields first, then register the stateid on the stable async_copy. result->cb_stateid is unchanged. Fixes: e0639dc5805a ("NFSD introduce async copy feature") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton --- fs/nfsd/nfs4proc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index fad01d67bf3f..1c674479d4ca 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -2272,11 +2272,21 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, async_copy->cp_src = kmalloc_obj(*async_copy->cp_src); if (!async_copy->cp_src) goto out_dec_async_copy_err; - if (!nfs4_init_copy_state(nn, copy)) + dup_copy_fields(copy, async_copy); + /* + * Register the copy stateid on the long-lived async_copy + * rather than on the transient COMPOUND argument buffer + * (&u->copy). nfs4_init_copy_state() installs a pointer to + * the copy_stateid_t in nn->s2s_cp_stateids, and that pointer + * outlives this call (it is removed only when the background + * copy finishes). Pointing it at &u->copy would leave a stale + * pointer into reused request memory that the laundromat and + * OFFLOAD_CANCEL later dereference. + */ + if (!nfs4_init_copy_state(nn, async_copy)) goto out_dec_async_copy_err; - memcpy(&result->cb_stateid, ©->cp_stateid.cs_stid, + memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); - dup_copy_fields(copy, async_copy); if ((READ_ONCE(copy->nf_dst->nf_file->f_mode) & FMODE_NOCMTIME) != 0) async_copy->attr_update = true; -- 2.55.0