[PATCH] NFS: keep in-flight slots when shrinking the session slot table

[Cheng Yongkang <teel4res@gmail.com>]

nfs4_reset_slot_table() shrinks the forechannel slot table to the new
session's max_reqs without checking whether any of the slots being
freed are still in use.  The session drain it follows only snapshots
highest_used_slotid once, while nfs4_setup_sequence() and
nfs41_assign_slot() deliberately let privileged RPCs (sa_privileged,
e.g. the DELEGRETURN sent while an inode is being evicted) allocate a
slot after that snapshot.  If such an RPC owns a slot with
slot_nr >= max_reqs, nfs4_shrink_slot_table() kfree()s it and the
reply path (decode_sequence(), nfs41_release_slot(), nfs4_free_slot())
later dereferences the freed slot: a slab-use-after-free.

Clamp the shrink target to highest_used_slotid + 1 when the table is
not empty, so only slots above the highest used slot are freed, and
stop resetting highest_used_slotid: the high-water mark is still needed
to release those slots and to complete a later drain.  max_slotid is
still set to the server's new highest slotid, so new RPCs cannot use
the preserved slots above the new max_reqs.  A server advertising
max_reqs == 0 arrives with server_highest_slotid == NFS4_NO_SLOT; make
that wrap explicit.

Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 fs/nfs/nfs4session.c | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index 175390e..869451c 100644
@@ -274,8 +274,25 @@
 		u32 ivalue)
 {
 	struct nfs4_slot **p;
+	u32 newsize = server_highest_slotid + 1;
+	u32 highest_used = tbl->highest_used_slotid;
 
-	nfs4_shrink_slot_table(tbl, server_highest_slotid + 1);
+	/*
+	 * Privileged RPCs are allowed to allocate slots after the session
+	 * drain has taken its snapshot, so slots above the server's new
+	 * highest slotid may still be owned by in-flight RPCs.  Shrink
+	 * only up to the highest slot that is still in use: every slot
+	 * above it is known to be free.
+	 *
+	 * A server advertising max_reqs == 0 arrives here with
+	 * server_highest_slotid == NFS4_NO_SLOT, for which the addition
+	 * above wraps to 0.
+	 */
+	if (server_highest_slotid == NFS4_NO_SLOT)
+		newsize = 0;
+	if (highest_used != NFS4_NO_SLOT && newsize <= highest_used)
+		newsize = highest_used + 1;
+	nfs4_shrink_slot_table(tbl, newsize);
 	p = &tbl->slots;
 	while (*p) {
 		(*p)->seq_nr = ivalue;
@@ -283,7 +300,12 @@
 		(*p)->seq_nr_last_acked = ivalue - 1;
 		p = &(*p)->next;
 	}
-	tbl->highest_used_slotid = NFS4_NO_SLOT;
+	/*
+	 * Leave highest_used_slotid untouched: when it is not
+	 * NFS4_NO_SLOT, the high-water mark belongs to an in-flight
+	 * privileged RPC whose slot survives the shrink, and
+	 * nfs4_free_slot() lowers it once that RPC completes.
+	 */
 	tbl->target_highest_slotid = server_highest_slotid;
 	tbl->server_highest_slotid = server_highest_slotid;
 	tbl->d_target_highest_slotid = 0;