nfs/localio: pin UUIDs during global invalidation

nfs_localio_invalidate_clients() moves UUID nodes embedded in nfs_client
objects to a private list, then walks that list without retaining the
containing clients. Concurrent client teardown can free an entry that
the iterator has already selected, causing a use-after-free.

Take a reference to each selected UUID under the namespace list lock.
Keep this reference count in nfs_common, independently of cl_count, and
have nfs_free_client() drain temporary UUID users before freeing the
client. Releasing a UUID reference wakes waiting probes and signals
completion when the last reference is dropped. It neither calls into
nfs.ko nor performs final NFS client teardown in the NFSD invalidation
context.

Keep the UUID on the namespace list until its files have been closed.
When another thread is already disabling it, wait for that thread to
finish unlinking it instead of repeatedly selecting the same head entry.
The wait releases the UUID spinlock so file cleanup can make progress.

Append registrations in sequence order and capture the last sequence
under the namespace list lock at the start of invalidation. Stop at that
boundary so new registrations cannot indefinitely extend the sweep,
even if its original last entry is removed concurrently.

Publish the LOCALIO association under the UUID and namespace list locks
before making the entry visible to invalidation. A temporary UUID
reference allows the handshake to drop the global lookup lock before
taking the UUID lock in the documented order; recheck the lookup in case
the probe was withdrawn. A new probe waits for temporary UUID users to
drain, then rechecks the association before reusing the UUID. This keeps
a transient invalidation reference from discarding the client's LOCALIO
revalidation attempt. Withdraw pending probes before dropping the owner's
UUID reference.

A deterministic same-base KASAN reproducer triggered the reported
use-after-free on the unpatched tree. With this patch, the same controlled
invalidation and teardown race completed without the target KASAN report
or another selected kernel diagnostic. A separate all-live run recorded
disable events for all 16 unique clients.

Test-only synchronization hooks verified that a second disabler waits for
unlink after ->net is cleared and that client teardown waits for a
temporary UUID reference to drain. NFSv4.2 and NFSv3 read, write, and
unmount smoke tests, export-flush and I/O stress, NFSD restarts, network
namespace lifecycle tests, and module unloads passed with KASAN and
lockdep enabled.

A full x86_64 kernel and modules build with GCC 13.3, CONFIG_WERROR=y,
NFS_FS=m, NFSD=m, and LOCALIO enabled completed without diagnostics.
Module metadata showed that nfs_localio.ko depends only on sunrpc, while
nfs.ko depends on lockd, nfs_localio, and sunrpc.

A separate NFS_FS=m, NFSD=y build also linked vmlinux successfully.

The vulnerability research and validation were conducted by members of
the Tobabz team as part of the Best of the Best 15th program.

Fixes: 085804110aa1 ("nfs_common: track all open nfsd_files per LOCALIO nfs_client")
Assisted-by: LLM
Signed-off-by: Jinpyo Lee <bint4b13@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h
index 3d91043254e6..1a8cfb045abc 100644
--- a/include/linux/nfslocalio.h
+++ b/include/linux/nfslocalio.h
@@ -8,8 +8,10 @@
 
 #if IS_ENABLED(CONFIG_NFS_LOCALIO)
 
+#include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/list.h>
+#include <linux/refcount.h>
 #include <linux/uuid.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/svcauth.h>
@@ -28,6 +30,11 @@ struct nfs_file_localio;
 typedef struct {
 	uuid_t uuid;
 	unsigned nfs3_localio_probe_count;
+	/* Owner reference plus temporary references held by nfs_common */
+	refcount_t refs;
+	struct completion released;
+	/* Namespace registration order, protected by list_lock */
+	u64 seq;
 	/* this struct is over a cacheline, avoid bouncing */
 	spinlock_t ____cacheline_aligned lock;
 	struct list_head list;
@@ -46,6 +53,7 @@ void nfs_uuid_is_local(const uuid_t *, struct list_head *, spinlock_t *,
 
 void nfs_localio_enable_client(struct nfs_client *clp);
 void nfs_localio_disable_client(struct nfs_client *clp);
+void nfs_localio_free_client(struct nfs_client *clp);
 void nfs_localio_invalidate_clients(struct list_head *nn_local_clients,
 				    spinlock_t *nn_local_clients_lock);
 
@@ -118,6 +126,10 @@ static inline void nfs_localio_disable_client(struct nfs_client *clp)
 {
 }
 
+static inline void nfs_localio_free_client(struct nfs_client *clp)
+{
+}
+
 #endif  /* CONFIG_NFS_LOCALIO */
 
 #endif  /* __LINUX_NFSLOCALIO_H */