Re: [PATCH] nfsd: fix use-after-free of DRC slot in nfsd4_sequence()

[Greg KH <greg@kroah.com>]

On Wed, Aug 19, 2026 at 02:43:26PM +0900, Tien Phan wrote:
> nfsd4_sequence() loads the slot addressed by the client-supplied
> seq->slotid, bounded only against se_fchannel.maxreqs:
> 
> 	if (seq->slotid >= session->se_fchannel.maxreqs)
> 		goto out_put_session;
> 	slot = xa_load(&session->se_slots, seq->slotid);
> 
> When the client acknowledges a slot-count reduction, the handler frees
> every slot in [se_target_maxslots, maxreqs):
> 
> 	if (session->se_target_maxslots < session->se_fchannel.maxreqs &&
> 	    slot->sl_generation == session->se_slot_gen &&
> 	    seq->maxslots <= session->se_target_maxslots)
> 		free_session_slots(session, session->se_target_maxslots);
> 
> but never checks that the slot it just loaded lies outside that range.
> A malicious NFSv4.1 client can pick seq->slotid >= se_target_maxslots
> (still < maxreqs, so the bound above passes) and, once the DRC slot
> shrinker has lowered se_target_maxslots below maxreqs, issue two SEQUENCE
> calls on that high slot: the first aligns slot->sl_generation with
> se_slot_gen, the second satisfies the reduce-ack condition and calls
> free_session_slots(), which kfree()s the very slot still referenced by
> the handler.  The slot is then written (slot->sl_seqid = seq->seqid,
> slot->sl_flags, cstate->slot = slot) and used for DRC caching -- a
> use-after-free write.
> 
> Reject a slotid that falls within the range about to be freed before
> freeing it, so the handler never operates on a freed slot.
> 
> Found with an in-tree KASAN harness driving the real free_session_slots()
> on a live slot xarray (KASAN: slab-use-after-free, write of size 4).
> 
> Fixes: fc8738c68d0b ("nfsd: add support for freeing unused session-DRC slots")
> Cc: stable@vger.kernel.org # 6.14+
> Signed-off-by: Tien Phan <tienpp@gmail.com>

Did you forget an Assisted-by: tag here?

thanks,

greg k-h