[PATCH] NFS: Destroy callback transports on initialization failure

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>

During NFSv4 callback initialization, the IPv4 listener is created
successfully, but the IPv6 listener fails to start. The error path
returns without cleaning up the IPv4 listener. As a result, the
transport remains attached to serv->sv_permsocks, causing svc_destroy()
to trigger a warning.

Call svc_xprt_destroy_all() when IPv6 listener creation fails to
close any transports that were already created. This ensures all
transports are cleaned up before the service is destroyed.

Reported-by: syzbot+8cbdf9aa6c281a4e6bbe@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/6aee17c4.8be4ead1.3b45e1.0199.GAE@xxxxxxxxxx/T/
Fixes: c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()")
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>
---
Note: Tested by syzbot using the reproducer. The kernel built successfully,
and the original WARNING was no longer reproduced.
---
 fs/nfs/callback.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index bc282b744f34..29134e2c56cd 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -61,9 +61,11 @@ static int nfs4_callback_up_net(struct svc_serv *serv, struct net *net)
 		dprintk("NFS: Callback listener port = %u (af %u, net %x)\n",
 			nn->nfs_callback_tcpport6, PF_INET6, net->ns.inum);
 	} else if (ret != -EAFNOSUPPORT)
-		goto out_err;
+		goto out_destroy_xprts;
 	return 0;
 
+out_destroy_xprts:
+	svc_xprt_destroy_all(serv, net, false);
 out_err:
 	return (ret) ? ret : -ENOMEM;
 }
-- 
2.43.0