Re: [PATCH] nfsd: hold cl_lock in client_has_state()

[Chuck Lever]

On Fri, 28 Aug 2026 00:19:25 -0400, Cen Zhang (Microsoft Security FORGE Labs) wrote:
> client_has_openowners() walks clp->cl_openowners and reads so_stateids
> without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
> cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
> creds can use-after-free the nfs4_openowner.
> 
> BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
>   fs/nfsd/nfs4state.c:3718 client_has_openowners()
>   nfsd4_exchange_id
>   nfsd4_proc_compound
>   nfsd_dispatch
>   svc_process
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] nfsd: hold cl_lock in client_has_state()
      commit: 6882aca9f9cabfaec5ea23d1512f345fbd288b65

--
Chuck Lever