From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F3DA3D3D00 for ; Mon, 3 Aug 2026 09:18:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785748731; cv=none; b=aYKkWJfIZse7TAJ7cPb96Yzcw+xzNnw3cxPzYhJkDvJIsJQ7fzFyd7SMFd7iuayMK4mBpTfHwQFfzq++cTEUE/dNmyhKaI0x6ukD851q0ikPk6goYNFZmBgBcGTpsVzzKoxJJJUM9EBYhgEgweGTMlCZNh26p2LIZLbGKBEvABE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785748731; c=relaxed/simple; bh=bqdhnVDcs6Zgsj2SdRzxXuWePCxIzjTm9QfphD4KaTI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=sxkmobBlQG7S4+F+MuTXKK/QS8ijc8shJIyUWvpso1YblxW5VANW1UTgrJXlmmUh5IGUja0d2r2gxhPhuhaxhiSDeFEisDlLtv9jlqSmqGT/DE6gcIarNPkNKHdEPAQzPADnXnKOt+nZj6nfrfHlDKu7FigJfKfONlDr1xkPFcQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Uw6h/Dv7; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Uw6h/Dv7" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so9571635e9.1 for ; Mon, 03 Aug 2026 02:18:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785748724; x=1786353524; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=L0Why+wsEH2NC6fGMzVjI2W/9nKKcfVedLRTdHacXB4=; b=Uw6h/Dv7gtCzVAEBGhSFf2un61jaP2wagVYuPOHS7rN/wMEskTY9Fn7R4JPrruTOz/ zD18lt2oIoX6Coe4KFlu0W76O0X9kux+oekpwJyyy+wIk5dGjj1+4tfNneRxsL/gzcb4 8B936gnYh5g+2DtiGvNgtFcPSGXgVoNxLwa8s4o9A63BL6zGcFQ+oG7BqL7YIp6Hm7vZ vY3VT/MbO5zH6CxroUzGgGCQS2OqilUJSnmdDOlYp/qM2eG857weVOLO6KIpx9iJr3B7 INCXhW+VsVtJ2EoHJok/HThuLoP5x7zIZH5DKPvMjXaPfEMpKHJD6jpmTyuWxMuLBXMC czHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785748724; x=1786353524; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=L0Why+wsEH2NC6fGMzVjI2W/9nKKcfVedLRTdHacXB4=; b=jpcFNCzHiMDjAc5/dMoXwr1nq5ZDWlyNliWZi9d/IjlnsZygsomQr/bV7JYn9vJyVj 5+6QLVYBV2yGSC5poJjI3fWEsB3Bu/k3pa+UL83aXtXMRK0zSPe7qni6FHO9JTHv14Hr vwmDDfsBrrVM8NG1SPynDgimmJBCAED9M+2NtME44EL513InQfDRjmXLTpGEwys/gMCQ lc2Owp5yw1K93pg4rTADElBzAVAHTvwBw1SgQ+YyUDMxx1OupD4MAGoIO4iYNDNrRyZY KJ8Jffht6ToL4qXA8phIq+9rIl1Xzj1PN06QvWg56o7LVMNgYtVWEalfB1oAQF/gv0sY YZxw== X-Forwarded-Encrypted: i=1; AHgh+Rotf2hesnBRVkvCCsD4I0rGcpHP+KJzP4NfQa4D+YhpLLu/SoWwAXcNH/4Jtui2CDZk2Ct0jtttJzjYhbg=@vger.kernel.org X-Gm-Message-State: AOJu0YyKtwU+/vMInLJFSNfyAFJAAK8F+M/p9VaZXDf1OTDV2SiYCcsQ eVKk67HQZsQAfSXaKhPSv2xeISZ0whrsgYP3X6CB9/paC9lzBLcaSMqM X-Gm-Gg: AR+sD13L1Nnxny4QHPO3RymiUnAuywnn/9BGZPXmejxTvrp2JghcV5shKdyLXIuagaE Pjf/m9an236HK3BSqhMImDJfLGBiDmw96IMXlHLj5rR8moDvNv2nVHUcIPk4kCDumAXn/mD2d4K v8tcXnjiyS7Y/ygdsJcYlQnQvLy/4SfA63fpwMrAArtd/MBCuGqRlKVTB7G1NZr9Yvc9/MofrWe QjqQ9/iFThr0dsbCwFFSSntnLy33/rpD4ZrLbLmCfNLQfh8tnGrjEh5XJTYDVzw7UMKpXxKCTTr t4fpgWj/zvwSSaNkizFDTD/iIFUa6sNkgjGTsBk84LSY4GVWG7dWmJFqIjGonoYHxoMZzMY0618 UpZ/w1S5Y9m1q5lSQ3Ypl6aYrVQb9yOz7MX9ODuX6W6DGBw9wCt7MxettmxU8K1kh/Nz91WHrRE acZgn1KmrpXEFWJU3bCuye9qbirdY2Du2h5ikW7wfK/zIVJ8G0sFFUtoUICm19NPh0uyW1Ieh4c VWKj+xpTpE2sQ869xOqooNvG2hulJerQwLGuCH90EboCvMBEEzg/r8n X-Received: by 2002:a05:600d:6405:20b0:495:5e86:4e11 with SMTP id 5b1f17b1804b1-4980c672c9fmr151889815e9.12.1785748723540; Mon, 03 Aug 2026 02:18:43 -0700 (PDT) Received: from valmpani.valmpani (cgn-195-14-217-60.nc.de. [195.14.217.60]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fd41d0064sm29956137f8f.5.2026.08.03.02.18.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2026 02:18:43 -0700 (PDT) From: Vasileios Almpanis Date: Mon, 03 Aug 2026 11:18:29 +0200 Subject: [PATCH] NFS: sysfs: fix use-after-free on delayed kobject release Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260803-nfs-v1-1-034176dab4a3@gmail.com> X-B4-Tracking: v=1; b=H4sIAORccGoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDCwNj3by0Yl2DZLMkcyNLE/NkI2MloMqCotS0zAqwKdGxtbUAuoMNZFU AAAA= X-Change-ID: 20260803-nfs-0c6b72947c23 To: Trond Myklebust , Anna Schumaker , Benjamin Coddington Cc: Trond Myklebust , linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org, Vasileios Almpanis X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785748722; l=2658; i=vasilisalmpanis@gmail.com; s=20260731; h=from:subject:message-id; bh=bqdhnVDcs6Zgsj2SdRzxXuWePCxIzjTm9QfphD4KaTI=; b=swsNU4eQbh8dAPLgHpAAoMIebwRi8fkX09nlwq8suqnzgEA/VaN4Sfwi4/wpjCHMstSkEa1sE K+fgUcMFaDcD4NXWgsUHYpH9FpLiaKk9IU1Q+XeyflG86CSEU4acOTt X-Developer-Key: i=vasilisalmpanis@gmail.com; a=ed25519; pk=gn5Uo6yL8Tlpq5uATxA3nqoq+U8eWLRbjD+bOk0qSpU= struct nfs_netns_client embeds two kobjects and is freed by nfs_netns_object_release(), the release function of nfs_net_kobj. Despite that the first one, p->kobject lives in the same allocation. Nothing keeps the allocation from being freed before p->kobject has been released. When CONFIG_DEBUG_KOBJECT_RELEASE=y each release is instead deferred to a delayed_work embedded in the kobject, with an independent random delay, and nfs_net_kobj frees the allocation first in some of those cases. p->kobject's timer is then left armed inside freed memory, and the following splat appears: [ 139.805951][ T131] kobject: 'nfs_client' (ffff888027fdb800): kobject_release, parent 0000000000000000 (delayed 300) [ 139.808019][ T131] kobject: 'net' (ffff888027fdb898): kobject_release, parent 0000000000000000 (delayed 100) BUG: KASAN: slab-use-after-free in __run_timers+0x932/0x980 Write of size 8 at addr ffff888027fdb868 by task swapper/0/0 Reproduced on a KASAN kernel with CONFIG_NFS_FS=y and CONFIG_DEBUG_KOBJECT_RELEASE=y by: for i in $(seq 16); do unshare -n true; done; sleep 20 Give p->kobject a reference on nfs_net_kobj for its whole lifetime and drop it from nfs_netns_client_release(), so the allocation is always freed after p->kobject has been released. Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique") Signed-off-by: Vasileios Almpanis --- fs/nfs/sysfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c index 3a197252a1329b30b7b957ee97a437bf18aa5d5b..a5ea51b5935ae700b32123da9ddfb676fa76889b 100644 --- a/fs/nfs/sysfs.c +++ b/fs/nfs/sysfs.c @@ -126,6 +126,7 @@ static void nfs_netns_client_release(struct kobject *kobj) kobject); kfree(rcu_dereference_raw(c->identifier)); + kobject_put(&c->nfs_net_kobj); } static const struct ns_common *nfs_netns_client_namespace(const struct kobject *kobj) @@ -187,6 +188,13 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent, return NULL; } + /* + * nfs_net_kobj's release frees the allocation that p->kobject + * itself lives in, so p->kobject holds a reference on it for + * its entire lifetime, dropped by nfs_netns_client_release(). + */ + kobject_get(&p->nfs_net_kobj); + if (kobject_init_and_add(&p->kobject, &nfs_netns_client_type, &p->nfs_net_kobj, "nfs_client") == 0) return p; --- base-commit: 075b74841bd0065a3bda3440873c747938e69b68 change-id: 20260803-nfs-0c6b72947c23 Best regards, -- Vasileios Almpanis