[PATCH] NFSD: Don't dereference cp_clp in async COPY tracepoints

[PATCH] NFSD: Don't dereference cp_clp in async COPY tracepoints

[Jeff Layton]

nfsd4_unhash_copy() and find_async_copy() clear cp_clp before
nfsd4_stop_copy() fires trace_nfsd_copy_async_cancel(), which reads
copy->cp_clp->cl_addr: NULL deref on shutdown or OFFLOAD_CANCEL. The
kthread's nfsd_copy_async{,_done} events race the same clear.

Pass the client explicitly: cp_stid.sc_client for async copies (never
cleared), cstate->clp for the sync paths.

Reported-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
Closes: https://lore.kernel.org/linux-nfs/179317462025.87538.12362003258355443382@stu.pku.edu.cn/
Fixes: 62a8642ba00a ("NFSD: Fix nfsd4_shutdown_copy()")
Fixes: 62c0f6eaf050 ("nfsd: fix UAF in async copy cancel and shutdown")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/nfs4proc.c | 10 +++++-----
 fs/nfsd/trace.h    | 20 ++++++++++++--------
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a50f9dcb3a31..b572210ee526 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1653,7 +1653,7 @@ static void release_copy_files(struct nfsd4_copy *copy);
 
 static void nfsd4_stop_copy(struct nfsd4_async_copy *copy)
 {
-	trace_nfsd_copy_async_cancel(&copy->cp_copy);
+	trace_nfsd_copy_async_cancel(copy->cp_stid.sc_client, &copy->cp_copy);
 	/*
 	 * Join the kthread before releasing its resources. The task_struct is
 	 * pinned in nfsd4_copy(), so kthread_stop() is safe even after the
@@ -2245,7 +2245,7 @@ static int nfsd4_do_async_copy(void *data)
 	struct nfsd4_copy *copy = &async->cp_copy;
 	__be32 nfserr = nfs_ok;
 
-	trace_nfsd_copy_async(copy);
+	trace_nfsd_copy_async(async->cp_stid.sc_client, copy);
 	if (nfsd4_ssc_is_inter(copy)) {
 		struct file *filp;
 
@@ -2280,7 +2280,7 @@ static int nfsd4_do_async_copy(void *data)
 	 * joining.
 	 */
 	set_bit(NFSD4_COPY_F_COMPLETED, &copy->cp_flags);
-	trace_nfsd_copy_async_done(copy);
+	trace_nfsd_copy_async_done(async->cp_stid.sc_client, copy);
 	atomic_dec(&copy->cp_nn->pending_async_copies);
 	if (copy->cp_res.wr_bytes_written > 0 && copy->attr_update)
 		nfsd_update_cmtime_attr(copy->nf_dst->nf_file, 0);
@@ -2306,7 +2306,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
 	copy->cp_clp = cstate->clp;
 	if (nfsd4_ssc_is_inter(copy)) {
-		trace_nfsd_copy_inter(copy);
+		trace_nfsd_copy_inter(cstate->clp, copy);
 		if (!inter_copy_offload_enable || nfsd4_copy_is_sync(copy)) {
 			status = nfserr_notsupp;
 			goto out;
@@ -2317,7 +2317,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 			goto out;
 		}
 	} else {
-		trace_nfsd_copy_intra(copy);
+		trace_nfsd_copy_intra(cstate->clp, copy);
 		status = nfsd4_setup_intra_ssc(rqstp, cstate, copy);
 		if (status)
 			goto out;
diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
index 951af645d1cb..e7b186307c21 100644
--- a/fs/nfsd/trace.h
+++ b/fs/nfsd/trace.h
@@ -2481,9 +2481,10 @@ TRACE_EVENT(nfsd_ctl_fh_key_set,
 
 DECLARE_EVENT_CLASS(nfsd_copy_class,
 	TP_PROTO(
+		const struct nfs4_client *clp,
 		const struct nfsd4_copy *copy
 	),
-	TP_ARGS(copy),
+	TP_ARGS(clp, copy),
 	TP_STRUCT__entry(
 		__field(bool, intra)
 		__field(bool, async)
@@ -2526,7 +2527,7 @@ DECLARE_EVENT_CLASS(nfsd_copy_class,
 		__entry->src_cp_pos = copy->cp_src_pos;
 		__entry->dst_cp_pos = copy->cp_dst_pos;
 		__entry->cp_count = copy->cp_count;
-		__assign_sockaddr(addr, &copy->cp_clp->cl_addr,
+		__assign_sockaddr(addr, &clp->cl_addr,
 				sizeof(struct sockaddr_in6));
 	),
 	TP_printk("client=%pISpc intra=%d async=%d "
@@ -2547,8 +2548,9 @@ DECLARE_EVENT_CLASS(nfsd_copy_class,
 
 #define DEFINE_COPY_EVENT(name)				\
 DEFINE_EVENT(nfsd_copy_class, nfsd_copy_##name,	\
-	TP_PROTO(const struct nfsd4_copy *copy),	\
-	TP_ARGS(copy))
+	TP_PROTO(const struct nfs4_client *clp,		\
+		 const struct nfsd4_copy *copy),	\
+	TP_ARGS(clp, copy))
 
 DEFINE_COPY_EVENT(inter);
 DEFINE_COPY_EVENT(intra);
@@ -2580,9 +2582,10 @@ TRACE_EVENT(nfsd_copy_done,
 
 DECLARE_EVENT_CLASS(nfsd_copy_async_done_class,
 	TP_PROTO(
+		const struct nfs4_client *clp,
 		const struct nfsd4_copy *copy
 	),
-	TP_ARGS(copy),
+	TP_ARGS(clp, copy),
 	TP_STRUCT__entry(
 		__field(int, status)
 		__field(bool, intra)
@@ -2627,7 +2630,7 @@ DECLARE_EVENT_CLASS(nfsd_copy_async_done_class,
 		__entry->src_cp_pos = copy->cp_src_pos;
 		__entry->dst_cp_pos = copy->cp_dst_pos;
 		__entry->cp_count = copy->cp_count;
-		__assign_sockaddr(addr, &copy->cp_clp->cl_addr,
+		__assign_sockaddr(addr, &clp->cl_addr,
 				sizeof(struct sockaddr_in6));
 	),
 	TP_printk("client=%pISpc status=%d intra=%d async=%d "
@@ -2650,8 +2653,9 @@ DECLARE_EVENT_CLASS(nfsd_copy_async_done_class,
 #define DEFINE_COPY_ASYNC_DONE_EVENT(name)		\
 DEFINE_EVENT(nfsd_copy_async_done_class,		\
 	nfsd_copy_async_##name,				\
-	TP_PROTO(const struct nfsd4_copy *copy),	\
-	TP_ARGS(copy))
+	TP_PROTO(const struct nfs4_client *clp,		\
+		 const struct nfsd4_copy *copy),	\
+	TP_ARGS(clp, copy))
 
 DEFINE_COPY_ASYNC_DONE_EVENT(done);
 DEFINE_COPY_ASYNC_DONE_EVENT(cancel);

---
base-commit: 19bbac00ad1cfa28e9127488f161ffc2ac03fad4
change-id: 20261028-nfsd-testing-1ee56f934cd8

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

Re: [PATCH] NFSD: Don't dereference cp_clp in async COPY tracepoints

[Chuck Lever]

On Wed, 28 Oct 2026 10:10:38 -0400, Jeff Layton wrote:
> nfsd4_unhash_copy() and find_async_copy() clear cp_clp before
> nfsd4_stop_copy() fires trace_nfsd_copy_async_cancel(), which reads
> copy->cp_clp->cl_addr: NULL deref on shutdown or OFFLOAD_CANCEL. The
> kthread's nfsd_copy_async{,_done} events race the same clear.
> 
> Pass the client explicitly: cp_stid.sc_client for async copies (never
> cleared), cstate->clp for the sync paths.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] NFSD: Don't dereference cp_clp in async COPY tracepoints
      commit: 944812cf2b775193097bd4d1f1dd96ab928d1d97

--
Chuck Lever