Jeff Layton 641e5e2085 lockd, nfsd: RCU-protect nlmsvc_ops dispatch ...

nlmsvc_ops is published by nfsd_lockd_init() and cleared by
nfsd_lockd_shutdown() with plain stores, while lockd dereferences
it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer
targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's
.text, so a stale load after rmmod nfsd results in either a NULL
deref or a module-text use-after-free.

Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear
via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module
*owner field to nlmsvc_binding and pin the module across indirect
calls with try_module_get/module_put. When the binding is torn down,
fall back to fput() to avoid leaking struct file references.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: [email protected]
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Chuck Lever <[email protected]>

2026-08-10 09:54:35 -04:00

..

bind.h

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

2026-08-10 09:54:35 -04:00