nlmsvc_grant_blocked() unlinks a block from nlm_blocked before it
retries the lock, then re-inserts it. nlmsvc_traverse_blocks() skips a
block that is not on nlm_blocked, so a teardown scan that runs during a
retry passes it by and the retry puts it back. The surviving block pins
its host. lockd warns that it could not shut down the host module, and
the host outlives its network namespace.

Hold the file's f_mutex across the retry, and extend the scan's hold
across its unlink, so a scan and a retry of the same file can no longer
interleave. Drop the mutex before releasing a block reference, since
the last put takes f_mutex. A retry that waited out a scan re-checks
under nlm_blocked_lock that its block is still queued and due.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260819162247.2970703-1-cel@kernel.org?part=1
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260822-lockd-retry-blocked-uaf-v3-2-761661eae60c@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

nlmsvc_retry_blocked() examines the block at the head of nlm_blocked
under nlm_blocked_lock, then releases the lock before calling
nlmsvc_grant_blocked() or retry_deferred_block(). The nlm_blocked list
reference is all that keeps the block alive across that window.
nlmsvc_grant_blocked() does take one of its own, but not until after
the lock has been dropped. Unmounting the nfsd filesystem while a lock
request is still blocked reaches nlmsvc_traverse_blocks(), which drops
the list reference and frees the block along with the nlm_rqst hanging
off it.

  BUG: KASAN: slab-use-after-free in nlm_async_call+0xd6/0x230
  Read of size 8 at addr ffff88811b04c808 by task lockd/8377
    nlm_async_call+0xd6/0x230
    nlmsvc_retry_blocked+0x61c/0x800
    lockd+0x144/0x1c0
  Freed by task 8392:
    nlmsvc_release_block+0x231/0x290
    nlmsvc_traverse_blocks+0x139/0x1b0
    nlm_traverse_files+0x1aa/0xa00
    nlmsvc_free_host_resources+0x12/0x60
    nlm_shutdown_hosts_net+0x127/0x280
    lockd_down+0xd5/0x1c0

Take a reference before releasing nlm_blocked_lock and drop it once
the retry has run.

Fixes: 0e4ac9d93515 ("lockd: handle fl_grant callbacks")
Cc: stable@vger.kernel.org
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-nfs/20260818235808.3458075-1-shuangpeng.kernel@gmail.com/
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260822-lockd-retry-blocked-uaf-v3-1-761661eae60c@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

lockd references "struct nfs_fh" but none of the other definitions
in linux/nfs.h. That header also pulls in cred.h, several sunrpc
headers, and uapi/linux/nfs.h, none of which lockd needs. A new
linux/nfs_fh.h provides "struct nfs_fh" and its helpers without the
rest of that surface.

Switch lockd's xdr.h to linux/nfs_fh.h, and drop the now-redundant
linux/nfs.h includes from svc.c and trace.h.

Link: https://patch.msgid.link/20260720141442.783935-3-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

Pull NFS client updates from Trond Myklebust:
 "Highlights include:

  Stable fixes:
   - Use-after-free fixes for the sunrpc client code
   - Delegation hash table leak
   - NULL dereference on lockowner allocation failure
   - Fix a handshake completion race in the TLS code
   - Fix an error sign checking issue when deciding whether the pNFS
     layout is still in use, or can be returned
   - Fix a layout segment leak in pnfs_layout_process()

  Other bugfixes:
   - Fix a missing NULL check in the rpcbind client
   - annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
   - nfs_inode_set_delegation() error paths should return the delegation
   - Use clear_and_wake_up_bit() in nfs_clear_invalid_mapping() and the
     pNFS code.
   - Fix the nfs4_alloc_client() error paths to free the IDR allocation
   - fix folio dereference before NULL check in
     nfs_inode_remove_request()
   - Fix delayed delegation return
   - Fix another state manager race with umount
   - Fix device leaks on parse failure
   - Avoid cancelling in-flight I/O during a layout recall if the server
     doesn't require it
   - flexfiles: report cancelled I/O as a layout error
   - flexfiles: fix NULL dereference for NFSv4.0 data servers
   - Fix incorrect argument passed to nfs4_delete_lease()
   - Fix several symlink issues resulting from nfs_atomic_open_v23()
   - Fix an uninitialised variable issue in the NFSv4.1 callback code
   - fix LAYOUTSTATS send buffer exhaustion

  Features and cleanups:
   - NFSv4.2: Allow the server to specify that file data may not be cached
   - localio: optimise I/O submission when when not doing memory reclaim
   - localio: Remove duplicate wait code in nfs_local_commit
   - flexfiles: support loosely coupled NFSv4.x data servers
   - pNFS: key the data server cache on the NFS version"

* tag 'nfs-for-7.3-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (33 commits)
  NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
  NFSv4/pnfs: key the data server cache on the NFS version
  NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
  pNFS: Fix EBUSY check in pnfs_layout_need_return
  NFSv4.1: zero referring call lists before decoding
  nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
  SUNRPC: wait for in-flight client TLS handshake callback
  NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
  lockd: fix NULL dereference on lockowner allocation failure
  NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
  NFSv4/flexfiles: support loosely coupled data servers
  NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
  NFSv4: pin the superblock for active state owners
  sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
  NFS/localio: issue commit inline when not in a memory-reclaim context
  NFS/localio: remove dead FLUSH_SYNC handling from nfs_local_commit
  NFS/localio: issue IO inline when not in a memory-reclaim context
  NFS: Fix delayed delegation return list handling
  NFS: Verify symlink inode before caching target
  NFS: fix folio dereference before NULL check in nfs_inode_remove_request()
  ...

nlmclnt_locks_init_private() installs NLM file lock operations even when
nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc()
then returns -ENOMEM, but the VFS still tears down the partially
initialized file_lock and calls locks_release_private().

That invokes nlmclnt_locks_release_private(), which dereferences
fl->fl_u.nfs_fl.owner and crashes because the owner was never installed.

Clear fl_ops before attempting to initialize the NLM private state, and
install the NLM lock operations only after a lockowner has been allocated
successfully.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

Now that svc_seq_show() and the nfsd netlink stats handler both use
the per-netns svc_stat vs_count arrays, the global per-version
vs_count percpu counters are no longer read by anything. Remove the
vs_count field from struct svc_version and all the associated
DEFINE_PER_CPU_ALIGNED arrays and initializers across nfsd, lockd,
and the NFS client callback service.

Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260717-exportd-netlink-v7-4-b7ce17b83b60@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

The generated server-side decoder and encoder for a void procedure
argument or result are named after the RPC program (for example,
nfs_svc_decode_void). xdrgen derives that prefix from the program
name alone, not the version, so two versions of one program built
into the same module emit the identical symbol. NFSv2 and NFSv3
both declare program NFS_PROGRAM; once both are converted, fs/nfsd
fails to link with multiple definitions of nfs_svc_decode_void and
nfs_svc_encode_void.

A void handler carries no program- or version-specific behavior:
each merely forwards to xdrgen_decode_void() or xdrgen_encode_void().
Define one shared pair, xdrgen_svc_decode_void() and
xdrgen_svc_encode_void(), in the xdrgen builtins, and stop the
program generator from emitting a per-program void handler.

lockd is the one in-tree consumer that already emits per-program
void handlers, so regenerate the NLMv3 and NLMv4 XDR code to drop
nlm_svc_{decode,encode}_void() and nlm4_svc_{decode,encode}_void()
and point both procedure tables at the shared handlers. The shared
handlers are identical to the generated ones they replace, so no
wire behavior changes.

Only the server (svc) handlers are affected. The client-side void
stubs remain static and per-program, so they do not collide.

Link: https://patch.msgid.link/20260712193122.116845-3-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

Clean up.

The declaration templates for structs, pointers, and typedefs each
begin with a blank line, which keeps successive declarations and the
include block above them visually separated. The enum declaration
template omits that blank line. trim_blocks collapses the template's
lone comment line to nothing, so the omission stayed invisible as
long as every generated header happened to lead with a non-enum
declaration.

Fixes: 4329010ad9c3 ("xdrgen: Address some checkpatch whitespace complaints")
Link: https://patch.msgid.link/20260712193122.116845-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>

When an NFSv3/NLM client issues multiple NLM_SHARE calls from a single
host for the same (file, owner) tuple, the current implementation
overwrites the recorded access and deny modes with the latest pair.
A subsequent NLM_UNSHARE then drops the entire entry, even if other
grants were implicitly subsumed by the most recent SHARE.  This is
particularly visible to Windows-style clients that map each open of
a file to a distinct NLM_SHARE, all carrying the same NLM owner
handle.  For example:

    1. SHARE(access=RW, deny=W)   -> entry [RW, deny W]
    2. SHARE(access=R,  deny=N)   -> entry [R, deny N]   (RW/W overwritten)
    3. UNSHARE(access=R, deny=N)  -> entry freed
    4. UNSHARE(access=RW, deny=W) -> nothing to release

NLM has no duplicate reply cache, so both SHARE and UNSHARE handlers
must be idempotent under UDP retransmit.

Track each (access, deny) pair with a single bit in a u16 bitmap.
fsh_access and fsh_mode are each in {0..3}, so there are 16 possible
pairs; index = (access << 2) | deny.  SHARE sets the bit, UNSHARE
clears it, both via idempotent bit operations.  s_access and s_mode
are recomputed as the union of the (access, deny) values whose bit
is set, and the entry is freed once s_access_deny_bmap reaches zero.

NLM_UNSHARE gains the access and deny modes as arguments so the
correct bit can be cleared.  The two callers in svcproc.c and
svc4proc.c are updated to forward the decoded values.

Signed-off-by: Oscar Ou <oscarou@synology.com>
Link: https://patch.msgid.link/20260703063856.2423734-1-oscarou@synology.com
Signed-off-by: Chuck Lever <cel@kernel.org>

The checked-in NLMv4 xdrgen output predates the addition of enum
value validation to generated decoders. As a result the decoders for
fsh4_mode, fsh4_access, and nlm4_stats still accept any 32-bit value,
while the current generator rejects values outside the enumeration.
Resync the generated files with the in-tree xdrgen by regenerating
from the unchanged nlm4.x specification.

This is a plain regeneration with no specification change; it also
refreshes the recorded specification modification time to show that
all existing enum decoders have picked up the xdrgen tool fix.

Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260630155638.874492-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>