[PATCH 0/7] nfsd/sunrpc: harden the netlink listener interfaces

[Jeff Layton <jlayton@kernel.org>]

syzbot keeps landing in nfsd_nl_listener_set_doit(), where a stall under
nfsd_mutex blocks every other NFSD netlink op. This is hardening rather than
a fix for any one report: it narrows what userland can push into that path
and shortens the worst stalls.

  1: reject transport names NFSD cannot instantiate, before nfsd_mutex is
     taken
  2: cap a listener_set request at 1024 entries
  3: stop svc_register() losing a registration error to a later program
  4: bound the local rpcbind client to a single 1s attempt
  5: report listener creation failures through extack
  6: listener_set validation tests
  7: a per-netns rpcbind stub, and the listener round-trip tests

Measured against a local rpcbind that accepts the connection and never
replies. The wait is paid per listener, since svc_xprt_create_from_sa()
passes flags of 0 and every listener therefore calls svc_register():

  per rpcbind call   10s AF_LOCAL, 60s loopback TCP  ->  1s
  per listener       20s / 120s                      ->  2s
  entries/request    bounded only by message size    ->  1024
  worst request      unbounded                       ->  ~34min

Three things this does not do:

- "rdma" is still accepted, so 1024 entries can still mean 1024
  request_module("svcrdma") upcalls under nfsd_mutex where svcrdma is
  unavailable. Not counted above.
- write_ports() reaches the same code with the same mutex held. It is
  legacy, so it is left alone.
- ~34min is still ~17x the hung-task threshold, so the reproducer should be
  expected to keep tripping the watchdog. The durable fix is to make rpcbind
  registration asynchronous so those RPCs stop running under nfsd_mutex at
  all. That needs behavioural changes we should discuss first, so it is a
  separate patchset.

Patch 3 is a flag day for CONFIG_NFS_LOCALIO=y: a registration failure now
aborts listener creation there too, matching CONFIG_NFS_LOCALIO=n. Details
in that patch.

Please consider these for v7.4.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Jeff Layton (7):
      NFSD: validate transport name in listener_set before serv creation
      NFSD: cap the number of listeners accepted in listener_set
      SUNRPC: keep the first error in svc_register()
      SUNRPC: bound the local rpcbind client timeout to 1s
      NFSD: report listener creation failures through extack
      selftests/nfsd: exercise listener_set request validation
      selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips

 fs/nfsd/nfsctl.c                                   |  42 +-
 net/sunrpc/rpcb_clnt.c                             |  12 +
 net/sunrpc/svc.c                                   |   9 +-
 tools/testing/selftests/Makefile                   |   1 +
 tools/testing/selftests/nfsd/.gitignore            |   1 +
 tools/testing/selftests/nfsd/Makefile              |   6 +
 tools/testing/selftests/nfsd/config                |   4 +
 .../testing/selftests/nfsd/nfsd_netlink_listener.c | 920 +++++++++++++++++++++
 tools/testing/selftests/nfsd/settings              |   1 +
 9 files changed, 987 insertions(+), 9 deletions(-)
---
base-commit: 0b6d2c7e3abca8d17fddeecb6e4c32a8438ec2fb
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>