[PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[Vasileios Almpanis]

struct nfs_netns_client embeds two kobjects and is freed by
nfs_netns_object_release(), the release function of nfs_net_kobj.
Despite that the first one, p->kobject lives in the same allocation.
Nothing keeps the allocation from being freed before p->kobject
has been released.

When CONFIG_DEBUG_KOBJECT_RELEASE=y each release is instead deferred to
a delayed_work embedded in the kobject, with an independent random
delay, and nfs_net_kobj frees the allocation first in some of those
cases. p->kobject's timer is then left armed inside freed memory, and
the following splat appears:

  [  139.805951][  T131] kobject: 'nfs_client' (ffff888027fdb800): kobject_release, parent 0000000000000000 (delayed 300)
  [  139.808019][  T131] kobject: 'net' (ffff888027fdb898): kobject_release, parent 0000000000000000 (delayed 100)

  BUG: KASAN: slab-use-after-free in __run_timers+0x932/0x980
  Write of size 8 at addr ffff888027fdb868 by task swapper/0/0

Reproduced on a KASAN kernel with CONFIG_NFS_FS=y and
CONFIG_DEBUG_KOBJECT_RELEASE=y by:

  for i in $(seq 16); do unshare -n true; done; sleep 20

Give p->kobject a reference on nfs_net_kobj for its whole lifetime and
drop it from nfs_netns_client_release(), so the allocation is always
freed after p->kobject has been released.

Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique")
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
---
 fs/nfs/sysfs.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c
index 3a197252a1329b30b7b957ee97a437bf18aa5d5b..a5ea51b5935ae700b32123da9ddfb676fa76889b 100644
--- a/fs/nfs/sysfs.c
+++ b/fs/nfs/sysfs.c
@@ -126,6 +126,7 @@ static void nfs_netns_client_release(struct kobject *kobj)
 			kobject);
 
 	kfree(rcu_dereference_raw(c->identifier));
+	kobject_put(&c->nfs_net_kobj);
 }
 
 static const struct ns_common *nfs_netns_client_namespace(const struct kobject *kobj)
@@ -187,6 +188,13 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent,
 			return NULL;
 		}
 
+		/*
+		 * nfs_net_kobj's release frees the allocation that p->kobject
+		 * itself lives in, so p->kobject holds a reference on it for
+		 * its entire lifetime, dropped by nfs_netns_client_release().
+		 */
+		kobject_get(&p->nfs_net_kobj);
+
 		if (kobject_init_and_add(&p->kobject, &nfs_netns_client_type,
 					&p->nfs_net_kobj, "nfs_client") == 0)
 			return p;

---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260803-nfs-0c6b72947c23

Best regards,
-- 
Vasileios Almpanis <vasilisalmpanis@gmail.com>

Re: [PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[Benjamin Coddington]

On 3 Aug 2026, at 5:18, Vasileios Almpanis wrote:

> struct nfs_netns_client embeds two kobjects and is freed by
> nfs_netns_object_release(), the release function of nfs_net_kobj.
> Despite that the first one, p->kobject lives in the same allocation.
> Nothing keeps the allocation from being freed before p->kobject
> has been released.
>
> When CONFIG_DEBUG_KOBJECT_RELEASE=y each release is instead deferred to
> a delayed_work embedded in the kobject, with an independent random
> delay, and nfs_net_kobj frees the allocation first in some of those
> cases. p->kobject's timer is then left armed inside freed memory, and
> the following splat appears:
>
>   [  139.805951][  T131] kobject: 'nfs_client' (ffff888027fdb800): kobject_release, parent 0000000000000000 (delayed 300)
>   [  139.808019][  T131] kobject: 'net' (ffff888027fdb898): kobject_release, parent 0000000000000000 (delayed 100)
>
>   BUG: KASAN: slab-use-after-free in __run_timers+0x932/0x980
>   Write of size 8 at addr ffff888027fdb868 by task swapper/0/0
>
> Reproduced on a KASAN kernel with CONFIG_NFS_FS=y and
> CONFIG_DEBUG_KOBJECT_RELEASE=y by:
>
>   for i in $(seq 16); do unshare -n true; done; sleep 20
>
> Give p->kobject a reference on nfs_net_kobj for its whole lifetime and
> drop it from nfs_netns_client_release(), so the allocation is always
> freed after p->kobject has been released.
>
> Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique")
> Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>

Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>

Ben

Re: [PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[Vasileios Almpanis]

Hello everyone, just checking on this patch. It has received required
review. Is there anything else needed before it can be merged?

Kind regards,
Vasileios Almpanis

-- 
Vasileios Almpanis <vasilisalmpanis@gmail.com>