kernel/git/next/linux-next.git/fs/lockd, branch master

lockd: fix swapped arguments in nlmsvc_match_ip()

2026-07-13T02:22:39+00:00

When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip, nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server sockaddr as the opaque @data argument: nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL); The match callback is later invoked from nlm_traverse_locks() as: match(lockhost, host); where the first argument is the nlm_host that owns the lock, and the second argument is the @data that was originally passed down (here the server sockaddr). This is the convention every other match callback relies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()): arg1 is the real nlm_host, arg2 is the caller-supplied reference value. nlmsvc_match_ip() has had these two arguments reversed ever since the unlock-by-IP feature was introduced in commit 4373ea84c84d ("lockd: unlock lockd locks associated with a given server ip"): return rpc_cmp_addr(nlm_srcaddr(host), datap); Here @host is actually the server sockaddr, so nlm_srcaddr(host) dereferences a struct sockaddr as a struct nlm_host and reads garbage at the offset of h_srcaddr; meanwhile @datap is actually the lock owner's nlm_host but is compared as a sockaddr. As a result the comparison practically never matches and locks are not released for the requested IP. Swap the arguments so the lock owner's source address is compared against the requested server address: return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host); Fixes: 4373ea84c84d ("lockd: unlock lockd locks associated with a given server ip") Cc: stable@vger.kernel.org Signed-off-by: Oscar Ou [ cel: fix the misleading typedef parameter names too ] Link: https://patch.msgid.link/20260617075738.1151797-1-oscarou@synology.com Signed-off-by: Chuck Lever

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

2026-07-13T02:22:39+00:00

nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260611-nfsd-testing-v2-16-5b90e276f2d9@kernel.org Signed-off-by: Chuck Lever

lockd: Use "%*phN" to dprintk() a cookie

2026-07-13T02:22:39+00:00

Simplifies the code and removes a 'not obviously bounded' strcpy(). Delete the local function nlmdbg_cookie2a() that did the equivalent. There is no need to worry about cookie->len being more than NLM_MAXCOOKIELEN (32), the buffer holding it is only that long. The existing length checks must pre-date this code being added in 2.4.26. Signed-off-by: David Laight Link: https://patch.msgid.link/20260608212042.25476-1-david.laight.linux@gmail.com Signed-off-by: Chuck Lever

lockd: pin next file across nlm_inspect_file lock-drop

2026-07-13T02:22:39+00:00

nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table. Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.com Signed-off-by: Chuck Lever

lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

2026-06-09T20:32:59+00:00

file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pc_argzero to zero for the converted procedures and moved file-handle population into nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes into lock->fh.data. When an NLMv4 client presents a file handle shorter than LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlm_lookup_file() misses the existing nlm_file entry, and lock-state lookups fail. Zero only the tail bytes that file_hash() would otherwise consume. Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte that file_hash() reads. Reported-by: Jeff Layton Closes: https://lore.kernel.org/r/5229a9746d723a3f830120c0b966510f75badfc2.camel@kernel.org Fixes: 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") Signed-off-by: Chuck Lever

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

2026-06-09T20:32:59+00:00

The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever

lockd: Plug nlm_file leak when nlm_do_fopen() fails

2026-06-09T20:32:59+00:00

A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever

lockd: Unify cast_status

2026-06-09T20:32:59+00:00

cast_status folds internal lock-daemon sentinels into NLMv1/v3 wire status codes for the v3 reply path. Two variants have existed since the original kernel import: a strict allowlist under CONFIG_LOCKD_V4 and a sentinel-translation form for the !CONFIG_LOCKD_V4 build. The split was never grounded in a behavioural difference -- nlmsvc_testlock and nlmsvc_lock, which feed cast_status, return the same set of values in both configurations -- and recent xdrgen conversions have narrowed the caller set further: nlm__int__stale_fh and nlm__int__failed are now translated at their point of origin in nlm3svc_lookup_file, and the cast_status wraps around nlmsvc_cancel_blocked and nlmsvc_unlock have been dropped because those functions return only wire codes. Collapse the two variants into one. The unified form keeps the CONFIG_LOCKD_V4 arm's allowlist, retains the nlm__int__deadlock translation, and folds anything else to nlm_lck_denied_nolocks after a pr_warn_once so an unexpected sentinel from a future refactor remains visible in the kernel log instead of being silently passed to the wire encoder. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Remove dead code from fs/lockd/xdr.c

2026-06-09T20:32:59+00:00

All NLMv3 server-side procedures now dispatch through xdrgen-generated encoder and decoder functions, leaving the hand-written XDR processing in fs/lockd/xdr.c with no remaining callers. Remove fs/lockd/xdr.c, the fs/lockd/svcxdr.h header it included, the Makefile entry, and the now-unused nlmsvc_decode_* / nlmsvc_encode_* prototypes from fs/lockd/xdr.h. The structure definitions and status code macros in xdr.h are retained as they are still used by the client-side code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Remove C macros that are no longer used

2026-06-09T20:32:59+00:00

The conversion of all NLMv3 procedures to xdrgen-generated XDR functions is complete. The hand-rolled XDR size calculation macros (Ck, No, St, Rg) and the nlm_void structure definition served only the older implementations and are now unused. Also removes NLMDBG_FACILITY, which was set to the client debug flag in server-side code but never referenced, and corrects a comment to specify "NLMv3 Server procedures". Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever