Re: [PATCH] nfsd: Fix dentry refcount leak in nfsd_set_fh_dentry()

[Chuck Lever]

On Sat, Jul 4, 2026, at 1:23 PM, Guangshuo Li wrote:
> nfsd_set_fh_dentry() gets a dentry reference before checking whether an
> NFSv2 or NFSv3 filehandle resolves to a V4ROOT export. Such filehandles
> are rejected, but the rejection path jumps to out before the dentry is
> stored in fhp->fh_dentry.
>
> As a result, fh_put() will not see the dentry, and the out path only
> drops the export reference. The dentry reference obtained by dget() or
> exportfs_decode_fh_raw() is therefore leaked.
>
> Add a separate error path for the V4ROOT rejection case that drops the
> dentry reference before dropping the export reference.
>
> Fixes: 8a7348a9ed70 ("nfsd: fix refcount leak in nfsd_set_fh_dentry()")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>

Thanks for the report. It appears that there is already a fix for this
issue queued in nfsd-next:

  https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/commit/?h=nfsd-next&id=ce7d3cc59012382bad5946b4cfc2cdcaabb81163


-- 
Chuck Lever