[PATCH v5 00/15] nfsd/sunrpc: harden the netlink listener set interface

[Jeff Layton]

This version just fixes up some errno handling confusion that was in v3
that Chuck pointed out. This version also drops ENAVAIL as a special
error code -- we can use EIO for that instead.

Please consider these for v7.4.

Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
---
Changes in v5 (all from the Sashiko review of v4):
- svc_xprt_clear_rpcb_unreg(): only clear listeners already marked for
  close, instead of every permsock in the net
- svc_register(): stop the version loop as soon as rpcbind goes quiet,
  even when vs_rpcb_optnl discarded the error
- listener_set: only blame rpcbind in the extack for the entry that
  actually hit it
- rpcb_register_call(): -ERESTARTSYS is not a "never reached the wire"
  case; the task can be signalled after RPC_TASK_SENT
- Tests: use linux/nfsd_netlink.h rather than open-coded ids, skip when
  the loopback ioctls fail, add NFSD's Kconfig deps to the fragment
- New patch: rpcb_register_inet{4,6}() NULL-deref when
  rpc_sockaddr2uaddr() fails
- Link to v4: https://lore.kernel.org/r/20260831-nfsd-nl-hang-v4-0-0f4e89139409@xxxxxxxxxx

Changes in v4:
- Use EIO instead of ENAVAIL to represent an unrecoverable rpcbind error
- Link to v3: https://lore.kernel.org/r/20260828-nfsd-nl-hang-v3-0-55026685c75d@xxxxxxxxxx

Changes in v3:
- Dropped v2's patch 4, the svc_register() unwind. rpcbind matches an UNSET
  on [program, version, netid], and the v2 fallback ignores the protocol
  completely. The unwind could therefore clear entries that belong to other
  live listeners. Chuck Lever found that.
- A failed registration stays fatal. Patch 3 makes CONFIG_NFS_LOCALIO=y
  agree with CONFIG_NFS_LOCALIO=n on that point.
- Tests: sem_register_refused now reads the listener set back, because
  -EACCES alone does not show that no listener was created.
  sem_create_failure_extack is new. The netlink socket now asks for
  NETLINK_EXT_ACK and NETLINK_CAP_ACK, so that a test can read the extack.
- Tests: FIXTURE_TEARDOWN removes any listener or thread that a test left
  behind. Those pinned the netns.
- Stop attempting to register any more listeners when the first
  svc_register() call fails.
- Bound the unregistration side the same way. svc_register(),
  svc_unregister() and the per-listener teardown in svc_delete_xprt() all
  give up once the local rpcbind stops answering, so one listener_set pays
  one timeout in each direction rather than one per listener.
- Link to v2: https://lore.kernel.org/r/20260811-nfsd-nl-hang-v2-0-c0c92b3953c3@xxxxxxxxxx

Changes in v2:
- New patch 4: when a later registration failed, svc_register() left the
  entries that it had already set in rpcbind. Those entries pointed at a
  port that the caller then closed.
- Tests: behavioural fixes for several tests. Several assertions checked
  only an errno that both the fixed kernel and the broken kernel return.
  val_bad_transport() now also requires that the rpcbind stub saw no
  traffic. val_second_entry_bad() requires that no listener started.
  func_empty_destroys requires that the kernel dropped the local rpcbind
  client and then connected again. The two -EBUSY tests require that the
  listener set does not change. find_listener() now matches the address
  too.
- Tests: the stub read the revents of a newly accepted pollfd that poll()
  had not written. The stub could therefore start a blocking read with no
  readiness event.
- Tests: the config fragment now includes NAMESPACES, SHMEM, TMPFS and
  UNIX. Without them, every test skipped.
- Link to v1: https://lore.kernel.org/r/20260810-nfsd-nl-hang-v1-0-2519fdd5bc1a@xxxxxxxxxx

---
Jeff Layton (15):
      NFSD: cap the number of listeners accepted in listener_set
      NFSD: validate transport name in listener_set before serv creation
      SUNRPC: keep the first error in svc_register()
      SUNRPC: bound the local rpcbind client timeout to 1s
      NFSD: report listener creation failures through extack
      SUNRPC: report local rpcbind calls that get no answer
      SUNRPC: stop svc_register() once rpcbind stops answering
      SUNRPC: stop the svc_unregister() sweep once rpcbind stops answering
      SUNRPC: stop unregistering listeners once rpcbind stops answering
      NFSD: stop registering with rpcbind after a failure in listener_set
      SUNRPC: check rpc_sockaddr2uaddr() for failure when registering
      selftests/nfsd: exercise listener_set request validation
      selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
      selftests/nfsd: check that listener_set asks rpcbind once
      selftests/nfsd: check that listener removal asks rpcbind once

 MAINTAINERS                                        |    1 +
 fs/nfsd/nfsctl.c                                   |   96 +-
 include/linux/sunrpc/clnt.h                        |    3 +-
 include/linux/sunrpc/svc.h                         |    7 +-
 net/sunrpc/rpcb_clnt.c                             |   38 +-
 net/sunrpc/svc.c                                   |   67 +-
 net/sunrpc/svc_xprt.c                              |   21 +
 tools/testing/selftests/Makefile                   |    1 +
 tools/testing/selftests/nfsd/.gitignore            |    1 +
 tools/testing/selftests/nfsd/Makefile              |    6 +
 tools/testing/selftests/nfsd/config                |   14 +
 .../testing/selftests/nfsd/nfsd_netlink_listener.c | 1323 ++++++++++++++++++++
 tools/testing/selftests/nfsd/settings              |    1 +
 13 files changed, 1558 insertions(+), 21 deletions(-)
---
base-commit: e247236b7ffa1e0940f834787feade8570c5db91
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a

Best regards,
-- 
Jeff Layton <jlayton@xxxxxxxxxx>