[PATCH 0/4] nfsd: follow-on fixes for directory delegations

[PATCH 0/4] nfsd: follow-on fixes for directory delegations

[Jeff Layton]

Just a few small fixes for problems that Sashiko noticed flagged during
review. None are super-critical but it'd be good to have them fixed
before the feature ships.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Jeff Layton (4):
      nfsd: check for FILEID_INVALID in setup_notify_fhandle
      nfsd: use empty string for directory name in NOTIFY4_CHANGE_DIR_ATTRS
      nfsd: check delegation status in nfsd4_cb_notify_done
      nfsd: fix ino_t format specifier in nfsd_handle_dir_event tracepoint

 fs/nfsd/nfs4state.c | 3 +++
 fs/nfsd/nfs4xdr.c   | 9 +++------
 fs/nfsd/trace.h     | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)
---
base-commit: 479723a81683c7a5bdaff48ec6968fad3ac1ae24
change-id: 20260523-dir-deleg-fixes-4205d8f25be6

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

[PATCH 1/4] nfsd: check for FILEID_INVALID in setup_notify_fhandle

[Jeff Layton]

exportfs_encode_inode_fh() can return FILEID_INVALID (255) when the
buffer is too small. Since this is a positive value, the existing
check (fileid_type < 0) won't catch it. If this happens, maxsize will
have been updated to the required (larger) size, and fhp->fh_size
could overflow the fh_raw buffer, leading to an out-of-bounds read
when the filehandle is later encoded onto the wire.

Add a check for FILEID_INVALID alongside the existing negative return
check.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 2143fb6d5e3f..2f8d26601581 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4209,7 +4209,7 @@ setup_notify_fhandle(struct dentry *dentry, struct nfs4_file *fi,
 	}
 
 	fileid_type = exportfs_encode_inode_fh(inode, fid, &maxsize, parent, flags);
-	if (fileid_type < 0)
+	if (fileid_type < 0 || fileid_type == FILEID_INVALID)
 		return false;
 
 	fhp->fh_fileid_type = fileid_type;

-- 
2.54.0

[PATCH 2/4] nfsd: use empty string for directory name in NOTIFY4_CHANGE_DIR_ATTRS

[Jeff Layton]

RFC 8881 Section 10.4.3 specifies that for NOTIFY4_CHANGE_DIR_ATTRS
events, the ne_file component name must be a zero-length string. The
code was incorrectly using the directory's own dentry name, which
could leak the local namespace to the client and cause cache
confusion.

Pass an empty string and zero length instead, and remove the
now-unnecessary name_snapshot.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/nfs4xdr.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 2f8d26601581..c6c50c376b23 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4404,17 +4404,15 @@ u8 *nfsd4_encode_dir_attr_change(struct xdr_stream *xdr, struct nfs4_delegation
 {
 	struct dentry *dentry = nf->nf_file->f_path.dentry;
 	struct notify_attr4 na = { };
-	struct name_snapshot n;
 	bool ret;
 	u8 *p = NULL;
 
 	if (!(dp->dl_notify_mask & BIT(NOTIFY4_CHANGE_DIR_ATTRS)))
 		return NULL;
 
-	take_dentry_name_snapshot(&n, dentry);
+	/* RFC 8881 s10.4.3: ne_file must be a zero-length string for dir attrs */
 	ret = nfsd4_setup_notify_entry4(&na.na_changed_entry, xdr,
-					dentry, dp, nf, (char *)n.name.name,
-					n.name.len);
+					dentry, dp, nf, "", 0);
 
 	/* Don't bother with the event if we're not encoding attrs */
 	if (ret && na.na_changed_entry.ne_attrs.attr_vals.len) {
@@ -4422,7 +4420,6 @@ u8 *nfsd4_encode_dir_attr_change(struct xdr_stream *xdr, struct nfs4_delegation
 		if (!xdrgen_encode_notify_attr4(xdr, &na))
 			p = NULL;
 	}
-	release_dentry_name_snapshot(&n);
 	return p;
 }
 

-- 
2.54.0

[PATCH 3/4] nfsd: check delegation status in nfsd4_cb_notify_done

[Jeff Layton]

If a delegation has been closed or revoked (sc_status is set), the
NFS4ERR_DELAY retry loop in nfsd4_cb_notify_done will spin
indefinitely. This holds the sc_count reference and prevents the
delegation from being freed.

Add a check for sc_status at the top of the function, matching the
pattern used in nfsd4_cb_recall_done, to terminate the callback
promptly when the delegation is no longer valid.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/nfs4state.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index acddd55a99d8..5e391f01d753 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3593,6 +3593,9 @@ nfsd4_cb_notify_done(struct nfsd4_callback *cb,
 	struct nfsd4_cb_notify *ncn = container_of(cb, struct nfsd4_cb_notify, ncn_cb);
 	struct nfs4_delegation *dp = container_of(ncn, struct nfs4_delegation, dl_cb_notify);
 
+	if (dp->dl_stid.sc_status)
+		return 1;
+
 	switch (task->tk_status) {
 	case -NFS4ERR_DELAY:
 		rpc_delay(task, 2 * HZ);

-- 
2.54.0

[PATCH 4/4] nfsd: fix ino_t format specifier in nfsd_handle_dir_event tracepoint

[Jeff Layton]

inode->i_ino is now a u64. Use the same size for the tracepoint.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/trace.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
index 3d0f0bd30d90..1d5d11f914f2 100644
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -1384,7 +1384,7 @@ TRACE_EVENT(nfsd_handle_dir_event,
 	TP_STRUCT__entry(
 		__field(u32, mask)
 		__field(dev_t, s_dev)
-		__field(ino_t, i_ino)
+		__field(ino_t, u64)
 		__string_len(name, name ? name->name : NULL,
 				   name ? name->len : 0)
 	),
@@ -1394,7 +1394,7 @@ TRACE_EVENT(nfsd_handle_dir_event,
 		__entry->i_ino = dir ? dir->i_ino : 0;
 		__assign_str(name);
 	),
-	TP_printk("inode=0x%x:0x%x:0x%lx mask=%s name=%s",
+	TP_printk("inode=0x%x:0x%x:0x%llx mask=%s name=%s",
 			MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
 			__entry->i_ino, show_fsnotify_mask(__entry->mask),
 			__get_str(name))

-- 
2.54.0

Re: [PATCH 4/4] nfsd: fix ino_t format specifier in nfsd_handle_dir_event tracepoint

[Jeff Layton]

On Sat, 2026-05-23 at 12:17 -0400, Jeff Layton wrote:
> inode->i_ino is now a u64. Use the same size for the tracepoint.
> 
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
>  fs/nfsd/trace.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
> index 3d0f0bd30d90..1d5d11f914f2 100644
> --- a/fs/nfsd/trace.h
> +++ b/fs/nfsd/trace.h
> @@ -1384,7 +1384,7 @@ TRACE_EVENT(nfsd_handle_dir_event,
>  	TP_STRUCT__entry(
>  		__field(u32, mask)
>  		__field(dev_t, s_dev)
> -		__field(ino_t, i_ino)
> +		__field(ino_t, u64)

My apologies. This should read:

                __field(u64, i_ino)

I had the fix in my tree and forgot to commit it before sending. Would
you like me to resend this one, or do you just want to fix it up?

>  		__string_len(name, name ? name->name : NULL,
>  				   name ? name->len : 0)
>  	),
> @@ -1394,7 +1394,7 @@ TRACE_EVENT(nfsd_handle_dir_event,
>  		__entry->i_ino = dir ? dir->i_ino : 0;
>  		__assign_str(name);
>  	),
> -	TP_printk("inode=0x%x:0x%x:0x%lx mask=%s name=%s",
> +	TP_printk("inode=0x%x:0x%x:0x%llx mask=%s name=%s",
>  			MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
>  			__entry->i_ino, show_fsnotify_mask(__entry->mask),
>  			__get_str(name))

-- 
Jeff Layton <jlayton@kernel.org>

Re: [PATCH 4/4] nfsd: fix ino_t format specifier in nfsd_handle_dir_event tracepoint

[Chuck Lever]

On Sun, May 24, 2026, at 8:09 AM, Jeff Layton wrote:
> On Sat, 2026-05-23 at 12:17 -0400, Jeff Layton wrote:
>> inode->i_ino is now a u64. Use the same size for the tracepoint.
>> 
>> Signed-off-by: Jeff Layton <jlayton@kernel.org>
>> ---
>>  fs/nfsd/trace.h | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
>> index 3d0f0bd30d90..1d5d11f914f2 100644
>> --- a/fs/nfsd/trace.h
>> +++ b/fs/nfsd/trace.h
>> @@ -1384,7 +1384,7 @@ TRACE_EVENT(nfsd_handle_dir_event,
>>  	TP_STRUCT__entry(
>>  		__field(u32, mask)
>>  		__field(dev_t, s_dev)
>> -		__field(ino_t, i_ino)
>> +		__field(ino_t, u64)
>
> My apologies. This should read:
>
>                 __field(u64, i_ino)
>
> I had the fix in my tree and forgot to commit it before sending. Would
> you like me to resend this one, or do you just want to fix it up?
>
>>  		__string_len(name, name ? name->name : NULL,
>>  				   name ? name->len : 0)
>>  	),

I fixed this in place and pushed out the update to nfsd-testing.


-- 
Chuck Lever

Re: [PATCH 0/4] nfsd: follow-on fixes for directory delegations

[Chuck Lever]

From: Chuck Lever <chuck.lever@oracle.com>

On Sat, 23 May 2026 12:17:33 -0400, Jeff Layton wrote:
> Just a few small fixes for problems that Sashiko noticed flagged during
> review. None are super-critical but it'd be good to have them fixed
> before the feature ships.

Applied to nfsd-testing, thanks!

[1/4] nfsd: check for FILEID_INVALID in setup_notify_fhandle
      commit: fb1d813dcb193d52322e3320543c029c2931f613
[2/4] nfsd: use empty string for directory name in NOTIFY4_CHANGE_DIR_ATTRS
      commit: 9e8c221e056f6bf4a525fa5d74ecad735855935d
[3/4] nfsd: check delegation status in nfsd4_cb_notify_done
      commit: 62fdbd7c4ce24aee5aa9698c256047d2e4071f30
[4/4] nfsd: fix ino_t format specifier in nfsd_handle_dir_event tracepoint
      commit: 04cc256388df5d2d284f4d9d3e9f22ebf974f806

--
Chuck Lever <chuck.lever@oracle.com>