Re: [BUG] [powerpc] [next-20260216/17] nfsd: use-after-free in cache_check_rcu() triggered by sosreport on ppc64le

["Chuck Lever" <cel@kernel.org>]

On Fri, May 1, 2026, at 3:06 AM, Jeff Layton wrote:
> On Fri, 2026-05-01 at 02:15 +0530, Misbah Anjum N wrote:
>> Hi,
>> 
>> Following up on my bug report, I have completed a git bisect and have 
>> critical new findings to report.
>> Ref: 
>> https://lore.kernel.org/linux-next/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/T/#u
>> 
>> Current Status: Bug Has Propagated from linux-next to Mainline.
>> First Bad commit identified: da6b5aae84beb0917ecb0c9fbc71169d145397ff
>> 
>> The use-after-free bug in cache_check_rcu() that I originally reported 
>> in linux-next (6.19.0-next-20260216/17) has now propagated into mainline 
>> and is confirmed present in:
>> - mainline (Tested on Latest kernel as of 2026-04-30 - commit 
>> 08d0d3466664)
>> - linux-next (Tested on Latest kernel as of 2026-04-30)
>> 
>> This bug is causing failures on ppc64le systems:
>> 1. Kernel panics: 100% reproducible crashes when sosreport runs
>> 2. CI/Testing failures: All automated Avocado-vt KVM testing on ppc64le 
>> is failing
>> 3. Use-after-free corruption: Memory corruption with corrupted pointers 
>> containing
>>     ASCII strings ("libz.so.", "export_cap") or poison patterns 
>> (0xcccccccccccccccc)
>> 
>
> Thanks for the bug report. I must have missed your earlier email.

You didn’t miss it. We responded to that report in February with
a fix that you and Neil both reviewed and it is in v7.0 now.

That fix addressed one instance of this problem; there are actually
several more, all in the same UAF class. I have a patch series nearly
complete to address these issues.

The issue Misbah reports here is not the same as the February issue,
though it is very similar.


> The commit you landed on is a merge commit and is not likely to be the
> cause, particularly since that merge was for x86 drivers and you're
> seeing this on PPC. Is this reproducible on other architectures?

We have an internal bug reporting the same stack trace on ARM64. Now
that we have both a reproducer and a platform that is easily accessible
it will be straightforward to confirm these issues are fully addressed
before we merge the new fixes.


-- 
Chuck Lever