Re: [PATCH] SUNRPC: fix netns use-after-free in write_gssp()

[Chuck Lever]

On Mon, 07 Sep 2026 01:54:35 -0700, Zijing Yin wrote:
> While fuzzing with a customized syzkaller, I hit a refcount warning in
> xprt_alloc(), reached from a write to /proc/net/rpc/use-gss-proxy:
> 
>   refcount_t: addition on 0; use-after-free.
>   WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xf8/0x120
>   CPU: 0 PID: 10404 Comm: syz.0.17 Not tainted 7.3.0-rc1-00096-gcfebfd3db73d
>   Call Trace:
>    <TASK>
>    xprt_alloc+0x83f/0x9d0
>    xs_setup_xprt+0xaf/0x3c0
>    xs_setup_local+0x47/0x7f0
>    xprt_create_transport+0x16c/0x730
>    rpc_create+0x38e/0x7f0
>    gssp_rpc_create+0xe2/0x180
>    set_gssp_clnt+0xba/0x1b0
>    write_gssp+0x200/0x310
>    proc_reg_write+0x240/0x330
>    vfs_write+0x2aa/0x1050
>    ksys_write+0x12a/0x250
>    do_syscall_64+0x117/0x750
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>    </TASK>
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] SUNRPC: fix netns use-after-free in write_gssp()
      commit: 85b91a0bdc1c38c97fb17449e6c0990104ebf66f

--
Chuck Lever