[PATCH v2 0/8] nfsd/sunrpc: harden the netlink listener interfaces

[Jeff Layton]

This version fixes a number of problems that Sashiko pointed out. The
more serious ones were preexisting issues, but we might as well fix
them while we're in the area. As before, the real way to address the
issues that syzbot keeps reporting is to make the rpcbind calls run
asynchronously.

syzbot keeps landing in nfsd_nl_listener_set_doit(), where a stall under
nfsd_mutex blocks every other NFSD netlink op. This is hardening rather than
a fix for any one report: it narrows what userland can push into that path
and shortens the worst stalls.

  1: reject transport names NFSD cannot instantiate, before nfsd_mutex is
     taken
  2: cap a listener_set request at 1024 entries
  3: stop svc_register() losing a registration error to a later program
  4: undo the registrations svc_register() made before it failed
  5: bound the local rpcbind client to a single 1s attempt
  6: report listener creation failures through extack
  7: listener_set validation tests
  8: a per-netns rpcbind stub, and the listener round-trip tests

Measured against a local rpcbind that accepts the connection and never
replies. The wait is paid per listener, since svc_xprt_create_from_sa()
passes flags of 0 and every listener therefore calls svc_register():

  per rpcbind call   10s AF_LOCAL, 60s loopback TCP  ->  1s
  per listener       20s / 120s                      ->  2s
  entries/request    bounded only by message size    ->  1024
  worst request      unbounded                       ->  ~34min

Three things this does not do:

- "rdma" is still accepted, so 1024 entries can still mean 1024
  request_module("svcrdma") upcalls under nfsd_mutex where svcrdma is
  unavailable. Not counted above.
- write_ports() reaches the same code with the same mutex held. It is
  legacy, so it is left alone.
- ~34min is still ~17x the hung-task threshold, so the reproducer should be
  expected to keep tripping the watchdog. The durable fix is to make rpcbind
  registration asynchronous so those RPCs stop running under nfsd_mutex at
  all. That needs behavioural changes we should discuss first, so it is a
  separate patchset.

Patch 3 is a flag day for CONFIG_NFS_LOCALIO=y: a registration failure now
aborts listener creation there too, matching CONFIG_NFS_LOCALIO=n. Details
in that patch.

Please consider these for v7.4.

To: Chuck Lever <cel@xxxxxxxxxx>
To: NeilBrown <neil@xxxxxxxxxx>
To: Olga Kornievskaia <okorniev@xxxxxxxxxx>
To: Dai Ngo <Dai.Ngo@xxxxxxxxxx>
To: Tom Talpey <tom@xxxxxxxxxx>
To: Trond Myklebust <trondmy@xxxxxxxxxx>
To: Anna Schumaker <anna@xxxxxxxxxx>
To: David S. Miller <davem@xxxxxxxxxxxxx>
To: Eric Dumazet <edumazet@xxxxxxxxxx>
To: Jakub Kicinski <kuba@xxxxxxxxxx>
To: Paolo Abeni <pabeni@xxxxxxxxxx>
To: Simon Horman <horms@xxxxxxxxxx>
To: J. Bruce Fields <bfields@xxxxxxxxxxxx>
To: Shuah Khan <shuah@xxxxxxxxxx>
Cc: linux-nfs@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Cc: netdev@xxxxxxxxxxxxxxx
Cc: Trond Myklebust <trondmy@xxxxxxxxx>
Cc: linux-kselftest@xxxxxxxxxxxxxxx
Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>

--- Changes in v2:
- New patch 4: svc_register() left the entries it had already set in
  rpcbind when a later one failed, pointing at a port the caller then
  closed.
- Tests: Behavioral fixes for several tests: several assertions only
  checked an errno that both the fixed and the broken kernel return.
  val_bad_transport() now requires that the rpcbind stub saw no traffic,
  val_second_entry_bad() that no listener came up, func_empty_destroys
  that the local rpcbind client was dropped and had to reconnect, and the
  two -EBUSY tests that the listener set is unchanged. find_listener()
  matches the address too.
- Tests: the stub read the revents of a freshly accepted pollfd that
  poll() had not written, so it could enter a blocking read with no
  readiness event.
- Tests: the config fragment gained NAMESPACES, SHMEM, TMPFS and UNIX;
  without them every test skipped.
- Link to v1: https://lore.kernel.org/r/20260810-nfsd-nl-hang-v1-0-2519fdd5bc1a@xxxxxxxxxx

---
Jeff Layton (8):
      NFSD: validate transport name in listener_set before serv creation
      NFSD: cap the number of listeners accepted in listener_set
      SUNRPC: keep the first error in svc_register()
      SUNRPC: undo partial rpcbind registrations when svc_register() fails
      SUNRPC: bound the local rpcbind client timeout to 1s
      NFSD: report listener creation failures through extack
      selftests/nfsd: exercise listener_set request validation
      selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips

 fs/nfsd/nfsctl.c                                   |   42 +-
 net/sunrpc/rpcb_clnt.c                             |   12 +
 net/sunrpc/svc.c                                   |   40 +-
 tools/testing/selftests/Makefile                   |    1 +
 tools/testing/selftests/nfsd/.gitignore            |    1 +
 tools/testing/selftests/nfsd/Makefile              |    6 +
 tools/testing/selftests/nfsd/config                |    8 +
 .../testing/selftests/nfsd/nfsd_netlink_listener.c | 1030 ++++++++++++++++++++
 tools/testing/selftests/nfsd/settings              |    1 +
 9 files changed, 1131 insertions(+), 10 deletions(-)
---
base-commit: 0b6d2c7e3abca8d17fddeecb6e4c32a8438ec2fb
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a

Best regards,
-- 
Jeff Layton <jlayton@xxxxxxxxxx>