[PATCH v3 00/14] nfsd/sunrpc: harden the netlink listener set interface

[Jeff Layton]

This series is quite a bit different from v2. First, I cleaned things up
along the lines of Chuck's review of v2, but then Olga suggested that we
should just give up on trying to do new rpcbind registrations when one
fails.

I've added a patches to do that and this now seems to fix the reproducer
that syzbot provided recently. I have high hopes that it will fix the
other syzbot hangs that have been reported.

This also sets a foundation for some other work I have that will move
the rpcbind registration into userland. I'll submit that series
separately after this one is resolved.

Please consider these for v7.4.

To: Chuck Lever <cel@xxxxxxxxxx>
To: NeilBrown <neil@xxxxxxxxxx>
To: Olga Kornievskaia <okorniev@xxxxxxxxxx>
To: Dai Ngo <Dai.Ngo@xxxxxxxxxx>
To: Tom Talpey <tom@xxxxxxxxxx>
To: Trond Myklebust <trondmy@xxxxxxxxxx>
To: Anna Schumaker <anna@xxxxxxxxxx>
To: David S. Miller <davem@xxxxxxxxxxxxx>
To: Eric Dumazet <edumazet@xxxxxxxxxx>
To: Jakub Kicinski <kuba@xxxxxxxxxx>
To: Paolo Abeni <pabeni@xxxxxxxxxx>
To: Simon Horman <horms@xxxxxxxxxx>
To: Shuah Khan <shuah@xxxxxxxxxx>
Cc: Slawomir Stepien <sst@xxxxxxxxx>
Cc: linux-nfs@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Cc: netdev@xxxxxxxxxxxxxxx
Cc: Trond Myklebust <trondmy@xxxxxxxxx>
Cc: linux-kselftest@xxxxxxxxxxxxxxx
Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>

--- Changes in v2:
- New patch 4: when a later registration failed, svc_register() left the
  entries that it had already set in rpcbind. Those entries pointed at a
  port that the caller then closed.
- Tests: behavioural fixes for several tests. Several assertions checked
  only an errno that both the fixed kernel and the broken kernel return.
  val_bad_transport() now also requires that the rpcbind stub saw no
  traffic. val_second_entry_bad() requires that no listener started.
  func_empty_destroys requires that the kernel dropped the local rpcbind
  client and then connected again. The two -EBUSY tests require that the
  listener set does not change. find_listener() now matches the address
  too.
- Tests: the stub read the revents of a newly accepted pollfd that poll()
  had not written. The stub could therefore start a blocking read with no
  readiness event.
- Tests: the config fragment now includes NAMESPACES, SHMEM, TMPFS and
  UNIX. Without them, every test skipped.
- Link to v1: https://lore.kernel.org/r/20260810-nfsd-nl-hang-v1-0-2519fdd5bc1a@xxxxxxxxxx

---
Changes in v3:
- Dropped v2's patch 4, the svc_register() unwind. rpcbind matches an UNSET
  on [program, version, netid], and the v2 fallback ignores the protocol
  completely. The unwind could therefore clear entries that belong to other
  live listeners. Chuck Lever found that.
- A failed registration stays fatal. Patch 3 makes CONFIG_NFS_LOCALIO=y
  agree with CONFIG_NFS_LOCALIO=n on that point.
- Tests: sem_register_refused now reads the listener set back, because
  -EACCES alone does not show that no listener was created.
  sem_create_failure_extack is new. The netlink socket now asks for
  NETLINK_EXT_ACK and NETLINK_CAP_ACK, so that a test can read the extack.
- Tests: FIXTURE_TEARDOWN removes any listener or thread that a test left
  behind. Those pinned the netns.
- Stop attempting to register any more listeners when the first
  svc_register() call fails.
- Bound the unregistration side the same way. svc_register(),
  svc_unregister() and the per-listener teardown in svc_delete_xprt() all
  give up once the local rpcbind stops answering, so one listener_set pays
  one timeout in each direction rather than one per listener.
- Link to v2: https://lore.kernel.org/r/20260811-nfsd-nl-hang-v2-0-c0c92b3953c3@xxxxxxxxxx

---
Jeff Layton (14):
      NFSD: cap the number of listeners accepted in listener_set
      NFSD: validate transport name in listener_set before serv creation
      SUNRPC: keep the first error in svc_register()
      SUNRPC: bound the local rpcbind client timeout to 1s
      NFSD: report listener creation failures through extack
      SUNRPC: report local rpcbind calls that get no answer
      SUNRPC: stop svc_register() once rpcbind stops answering
      SUNRPC: stop the svc_unregister() sweep once rpcbind stops answering
      SUNRPC: stop unregistering listeners once rpcbind stops answering
      NFSD: stop registering with rpcbind after a failure in listener_set
      selftests/nfsd: exercise listener_set request validation
      selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
      selftests/nfsd: check that listener_set asks rpcbind once
      selftests/nfsd: check that listener removal asks rpcbind once

 MAINTAINERS                                        |    1 +
 fs/nfsd/nfsctl.c                                   |   87 +-
 include/linux/sunrpc/clnt.h                        |    3 +-
 include/linux/sunrpc/svc.h                         |    7 +-
 net/sunrpc/rpcb_clnt.c                             |   22 +-
 net/sunrpc/svc.c                                   |   65 +-
 net/sunrpc/svc_xprt.c                              |   20 +
 tools/testing/selftests/Makefile                   |    1 +
 tools/testing/selftests/nfsd/.gitignore            |    1 +
 tools/testing/selftests/nfsd/Makefile              |    6 +
 tools/testing/selftests/nfsd/config                |    8 +
 .../testing/selftests/nfsd/nfsd_netlink_listener.c | 1328 ++++++++++++++++++++
 tools/testing/selftests/nfsd/settings              |    1 +
 13 files changed, 1529 insertions(+), 21 deletions(-)
---
base-commit: e247236b7ffa1e0940f834787feade8570c5db91
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a

Best regards,
-- 
Jeff Layton <jlayton@xxxxxxxxxx>