Re: [PATCH V5] nfsd: fix nfsd4_create_reclaim_record_grace crp null-ptr-deref in nfs4recover

[Jeff Layton <jlayton@kernel.org>]

On Thu, 2026-08-06 at 15:37 +0800, Lai Zewei wrote:
> nfs4_client_to_reclaim() may return NULL if alloc_reclaim() fails. 
> The caller __nfsd4_create_reclaim_record_grace() then unconditionally
> dereferences the returned pointer via crp->cr_clp = clp, leading to a
> null-ptr-deref crash.
> 
> Add a NULL check before assignment. If crp is NULL, just return.
> 
> Fixes: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")
> Signed-off-by: Lai Zewei <laizewei3@huawei.com>
> ---
>  fs/nfsd/nfs4recover.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
> index 6ea25a52d2f4..005e3990da99 100644
> --- a/fs/nfsd/nfs4recover.c
> +++ b/fs/nfsd/nfs4recover.c
> @@ -116,7 +116,8 @@ __nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
>  	struct nfs4_client_reclaim *crp;
>  
>  	crp = nfs4_client_to_reclaim(name, princhash, nn);
> -	crp->cr_clp = clp;
> +	if (crp)
> +		crp->cr_clp = clp;
>  }
>  
>  static void

I suppose this is the best we can do here.

As an aside, it's probably time to start a discussion about (finally)
deprecating the legacy client tracking code. We've had it marked as
"legacy" for several years now, and the intention was always to
eventually get rid of it.

Reviewed-by: Jeff Layton <jlayton@kernel.org>