linux.git/fs/nfs, branch v7.2

NFSv4.2: fix nfs4_listxattr size accounting

2026-07-31T17:27:25+00:00

A call to listxattr() with a buffer size of 0 returns the actual
size of the buffer needed for a subsequent call. On an NFSv4.2
mount this triggers the following oops:

  [  399.768687] BUG: kernel NULL pointer dereference, address: 0000000000000000
  [  399.768705] RIP: 0010:_copy_from_pages+0x44/0xe0
  [  399.768722] Call Trace:
  [  399.768723]  nfs4_xattr_alloc_entry+0x1bf/0x1e0
  [  399.768730]  nfs4_xattr_cache_set_list+0x43/0x1f0
  [  399.768731]  nfs4_listxattr+0x21f/0x250
  [  399.768733]  vfs_listxattr+0x55/0xa0
  [  399.768736]  listxattr+0x23/0x160
  [  399.768737]  path_listxattrat+0xba/0x1e0
  [  399.768739]  do_syscall_64+0xe2/0x680

security_inode_listsecurity() (via the xattr_list_one() helper) now
decrements the remaining size even when the buffer pointer is NULL, so
in the size-query case, 'left' underflows to a huge size_t value. As a
result, nfs4_listxattr_nfs4_user() treats the NULL buffer as a real one,
leading to a NULL pointer dereference in _copy_from_pages().

security_inode_listsecurity() does not return the number of bytes
it added to the list, so the code derived it as
'size - error - left'. That is also wrong in the size-query case:
the generic_listxattr() contribution is only subtracted from 'left'
when a buffer is present. Thus, the query result comes up short by
exactly that contribution (e.g., "system.nfs4_acl" on a mount with
ACL support), and a caller that allocates the returned size gets
-ERANGE on the subsequent call.

Declare 'left' as ssize_t, use a scratch copy to measure security
hook consumption, and only decrement 'left' if a buffer is present.

Fixes: f71ece9712b7 ("security,fs,nfs,net: update security_inode_listsecurity() interface")
Suggested-by: Paul Moore 
Signed-off-by: Achilles Gaikwad 
Reviewed-by: Paul Moore 
Signed-off-by: Anna Schumaker

NFS: Decrement refcounts if allocating nfs_free_stateid_data fails

2026-07-20T15:04:04+00:00

I noticed that we were immediately exiting this function if the
allocation fails, leaving the client and server object refcounts bumped.
Fix this by creating a common exit point to clean up dangling
references.

Fixes: 576acc259146 ("nfs4: take a reference on the nfs_client when running FREE_STATEID")
Signed-off-by: Anna Schumaker

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

2026-07-20T15:03:56+00:00

Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

Reported-by: Dan Aloni 
Fixes: 7c1d5fae4a87 ("NFSv4: Convert nfs41_free_stateid to use an asynchronous RPC call")
Tested-by: Dan Aloni 
Signed-off-by: Anna Schumaker

NFS: Charge unstable writes by request size, not folio size

2026-07-08T18:43:40+00:00

nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and
uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per
*request* added to or removed from a commit list. This is correct only
when a folio has a single associated request. When pg_test splits a
folio into N sub-folio requests (e.g. pNFS flexfiles striping with a
stripe unit smaller than the folio size, or plain wsize-limited
splitting), each of the N requests independently charges the whole
folio's page count, inflating the accounting by a factor of N per
folio. With large folios and small stripe units this reaches multiple
orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can
charge up to 512x its real size, pushing global dirty+writeback
accounting past the system's dirty threshold and forcing every
buffered writer on the host into the hard-throttle path, including
unrelated in-kernel NFS server threads sharing the box.

Charge each request only for the pages it actually covers.

Fixes: 0c493b5cf16e ("NFS: Convert buffered writes to use folios")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington 
Assisted-By: Claude Sonnet 5 
Signed-off-by: Anna Schumaker

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

2026-07-08T18:42:02+00:00

POSIX requires write permission to truncate a file, so an open() that
specifies O_TRUNC must be authorized for write access regardless of the
O_ACCMODE access mode.

nfs_open_permission_mask() builds the access mask passed to
nfs_may_open(), which is the local authorization gate for OPENs the
client serves itself from a cached write delegation via the
can_open_delegated() path in nfs4_try_open_cached().  The mask is
derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a
file the caller cannot write requests only MAY_READ and passes the
local check.  The OPEN is then satisfied locally and the truncation is
issued to the server as a SETATTR(size=0) over the delegation stateid,
which the server accepts under standard write-delegation semantics.
POSIX requires that this open fail with EACCES.

Include MAY_WRITE in the mask whenever O_TRUNC is set so the local
check matches the access the server would have enforced.

Suggested-by: Trond Myklebust 
Fixes: af22f94ae02a ("NFSv4: Simplify _nfs4_do_access()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington 
Signed-off-by: Anna Schumaker

Merge tag 'nfs-for-7.2-1' of git://git.linux-nfs.org/projects/anna/linux-nfs

2026-06-24T01:36:41+00:00

Pull NFS client updates from Anna Schumaker:
 "New features:
   - XPRTRDMA: Decouple req recycling from RPC completion
   - NFS: Expose FMODE_NOWAIT for read-only files

  Bugfixes:
   - SUNRPC:
      - Fix sunrpc sysfs error handling
      - Fix uninitialized xprt_create_args structure
   - XPRTRDMA:
      - Harden connect and reply handling
   - NFS:
      - Fix EOF updates after fallocate/zero-range
      - Keep PG_UPTODATE clear after read errors in page groups
      - Use nfsi->rwsem to protect traversal of the file lock list
      - Prevent resource leak in nfs_alloc_server()
   - NFSv4:
      - Clear exception state on successful mkdir retry
      - Don't skip revalidate when holding a dir delegation and attrs are stale
   - pNFS:
      - Fix use-after-free in pnfs_update_layout()
      - Defer return_range callbacks until after inode unlock
      - Fix LAYOUTCOMMIT retry loop on OLD_STATEID
      - Reject zero-length r_addr in nfs4_decode_mp_ds_addr
   - NFS/flexfiles:
      - Reject zero-length filehandle version arrays
      - Fix checking if a layout is striped
      - Fixes for honoring FF_FLAGS_NO_IO_THRU_MDS

  Other cleanups and improvements:
   - Remove the fileid field from struct nfs_inode
   - Move long-delayed xprtrdma work onto the system_dfl_long_wq
   - Convert xprtrdma send buffer free list to an llist
   - Show "" for cert_serial and privkey_serial mount options"

* tag 'nfs-for-7.2-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (42 commits)
  NFS: Use common error handling code in nfs_alloc_server()
  NFS: Prevent resource leak in nfs_alloc_server()
  NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
  nfs: don't skip revalidate on directory delegation when attrs flagged stale
  xprtrdma: Return sendctx slot after Send preparation failure
  xprtrdma: Repost Receive buffers for malformed replies
  xprtrdma: Sanitize the reply credit grant after parsing
  xprtrdma: Fix bcall rep leak and unbounded peek
  xprtrdma: Resize reply buffers before reposting receives
  xprtrdma: Check frwr_wp_create() during connect
  xprtrdma: Initialize re_id before removal registration
  xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
  xprtrdma: Convert send buffer free list to llist
  NFS: correct CONFIG_NFS_V4 macro name in #endif comment
  nfs: use nfsi->rwsem to protect traversal of the file lock list
  NFSv4.1/pNFS: fix LAYOUTCOMMIT retry loop on OLD_STATEID
  nfs: expose FMODE_NOWAIT for read-only files
  nfs: add nowait version of nfs_start_io_direct
  NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
  NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
  ...

Merge tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-06-18T16:14:15+00:00

Pull nfsd updates from Chuck Lever:
 "Jeff Layton wired up netlink upcalls for the auth.unix.ip and
  auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh caches
  in NFSD. The new kernel-user API is more extensible and lays the
  groundwork for retiring the old pipe interface.

  The default NFS r/w block size rises to 4MB on hosts with at least
  16GB of RAM, reducing per-RPC overhead on fast networks. Smaller
  machines keep their previously computed default, and the value remains
  tunable through /proc/fs/nfsd/max_block_size.

  Chuck Lever converted the server's RPCSEC GSS Kerberos code to the
  kernel's shared crypto/krb5 library. The conversion retires and
  removes SunRPC's bespoke implementation of Kerberos v5, but keeps
  RPCSEC GSS-API.

  Continuing the xdrgen migration that converted the NLMv4 server XDR
  layer in v7.1, Chuck Lever converted the NLM version 3 server-side XDR
  layer from hand-written C to xdrgen-generated code. As with the NLMv4
  conversion in v7.1, the goals are improved memory safety, lower
  maintenance burden, and groundwork for generation of Rust code for
  this layer instead of C.

  Chuck Lever fixed an issue where lingering NFSv4 state pins a mounted
  file system after it is unexported. A new netlink-based mechanism can
  now release NLM locks and NFSv4 state by client address, by
  filesystem, and by export. Now an administrator can quiesce an export
  cleanly before unmounting it.

  The remaining patches are bug fixes, clean-ups, and minor
  optimizations, including a batch of memory-leak and use-after-free
  fixes in the ACL, lockd, and TLS handshake paths, many of them
  reported by Chris Mason. Sincere thanks to all contributors,
  reviewers, testers, and bug reporters who participated in the v7.2
  NFSD development cycle"

* tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (106 commits)
  svcrdma: wake sq waiters when the transport closes
  nfsd: reset write verifier on deferred writeback errors
  nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
  sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  nfsd: fix posix_acl leak on SETACL decode failure
  nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
  nfsd: check get_user() return when reading princhashlen
  nfsd: fix inverted cp_ttl check in async copy reaper
  nfsd: fix dead ACL conflict guard in nfsd4_create
  NFSD: Fix SECINFO_NO_NAME decode error cleanup
  sunrpc: harden rq_procinfo lifecycle to prevent double-free
  SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
  SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  nfsd: release layout stid on setlease failure
  lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
  lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
  lockd: Plug nlm_file leak when nlm_do_fopen() fails
  Revert "NFSD: Defer sub-object cleanup in export put callbacks"
  Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers"
  ...

NFS: Use common error handling code in nfs_alloc_server()

2026-06-17T18:07:09+00:00

Use an additional label so that a bit of exception handling can be better
reused at the end of this function implementation.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Anna Schumaker

NFS: Prevent resource leak in nfs_alloc_server()

2026-06-17T18:07:09+00:00

It was overlooked to call ida_free() after a failed nfs_alloc_iostats() call.
Thus add the missed function call in an if branch.

Fixes: 1c7251187dc067a6d460cf33ca67da9c1dd87807 ("NFS: add superblock sysfs entries")
Cc: stable@vger.kernel.org
Reported-by: Christophe Jaillet 
Closes: https://lore.kernel.org/linux-nfs/1c8e10c9-def7-4f0d-8aa1-23c8035a38c8@wanadoo.fr/
Signed-off-by: Markus Elfring 
Signed-off-by: Anna Schumaker

Merge tag 'lsm-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2026-06-17T11:34:16+00:00

Pull lsm update from Paul Moore:
 "A single LSM update the security_inode_listsecurity() hook to be able
  to leverage the xattr_list_one() helper function.

  We wanted to do this for a while, but we needed to fixup the callers
  in the NFS code first. With the NFS code changes shipping in Linux
  v7.0 and no one complaining, it seemed a good time to complete the
  shift"

* tag 'lsm-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  security,fs,nfs,net: update security_inode_listsecurity() interface