[PATCH] nfsd: hold cl_lock in client_has_state()

[PATCH] nfsd: hold cl_lock in client_has_state()

[Cen Zhang (Microsoft Security FORGE Labs)]

client_has_openowners() walks clp->cl_openowners and reads so_stateids
without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
creds can use-after-free the nfs4_openowner.

BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
  fs/nfsd/nfs4state.c:3718 client_has_openowners()
  nfsd4_exchange_id
  nfsd4_proc_compound
  nfsd_dispatch
  svc_process

Take clp->cl_lock while client_has_state() walks the openowner list.

Fixes: 4eaea1342507 ("nfsd: improve client_has_state to check for unused openowners")
Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Cc: AutonomousCodeSecurity@microsoft.com
Cc: stable@vger.kernel.org
Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
---
 fs/nfsd/nfs4state.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 18e17232cf94..8d7a4c2eadbe 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4216,12 +4216,18 @@ nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
 static bool client_has_openowners(struct nfs4_client *clp)
 {
 	struct nfs4_openowner *oo;
+	bool found = false;
 
+	spin_lock(&clp->cl_lock);
 	list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
-		if (!list_empty(&oo->oo_owner.so_stateids))
-			return true;
+		if (!list_empty(&oo->oo_owner.so_stateids)) {
+			found = true;
+			break;
+		}
 	}
-	return false;
+	spin_unlock(&clp->cl_lock);
+
+	return found;
 }
 
 static bool client_has_state(struct nfs4_client *clp)

base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
-- 
2.55.0

Re: [PATCH] nfsd: hold cl_lock in client_has_state()

[Greg KH]

On Fri, Aug 28, 2026 at 12:19:25AM -0400, Cen Zhang (Microsoft Security FORGE Labs) wrote:
> client_has_openowners() walks clp->cl_openowners and reads so_stateids
> without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
> cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
> creds can use-after-free the nfs4_openowner.
> 
> BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
>   fs/nfsd/nfs4state.c:3718 client_has_openowners()
>   nfsd4_exchange_id
>   nfsd4_proc_compound
>   nfsd_dispatch
>   svc_process
> 
> Take clp->cl_lock while client_has_state() walks the openowner list.
> 
> Fixes: 4eaea1342507 ("nfsd: improve client_has_state to check for unused openowners")
> Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> Cc: AutonomousCodeSecurity@microsoft.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>

Please use your microsoft.com email address, and not a random gmail.com
address.  It's kind of odd that Microsoft would have to rely on Google
to send kernel patches :)

thanks,

greg k-h

Re: [PATCH] nfsd: hold cl_lock in client_has_state()

[Cen Zhang (Microsoft)]

> Please use your microsoft.com email address, and not a random gmail.com
> address.

Sorry for making you raise this again. I will hold off on new patch
submissions until my approved Microsoft email address is available,
which should be soon.

Thanks,
Cen

Re: [PATCH] nfsd: hold cl_lock in client_has_state()

[Chuck Lever]

On Fri, Aug 28, 2026, at 1:29 AM, Greg KH wrote:
> On Fri, Aug 28, 2026 at 12:19:25AM -0400, Cen Zhang (Microsoft Security 
> FORGE Labs) wrote:
>> client_has_openowners() walks clp->cl_openowners and reads so_stateids
>> without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
>> cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
>> creds can use-after-free the nfs4_openowner.
>> 
>> BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
>>   fs/nfsd/nfs4state.c:3718 client_has_openowners()
>>   nfsd4_exchange_id
>>   nfsd4_proc_compound
>>   nfsd_dispatch
>>   svc_process
>> 
>> Take clp->cl_lock while client_has_state() walks the openowner list.
>> 
>> Fixes: 4eaea1342507 ("nfsd: improve client_has_state to check for unused openowners")
>> Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
>> Cc: AutonomousCodeSecurity@microsoft.com
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
>
> Please use your microsoft.com email address, and not a random gmail.com
> address.  It's kind of odd that Microsoft would have to rely on Google
> to send kernel patches :)

Greg, would you prefer that I hold off on applying this to nfsd-testing
until Cen can post this one again?


-- 
Chuck Lever