* Re: [syzbot] [nfs?] [net?] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
2026-09-07 17:44 [syzbot] [nfs?] [net?] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall syzbot
@ 2026-09-07 19:15 ` Chuck Lever
2026-09-07 19:31 ` syzbot
2026-09-14 12:05 ` Forwarded: [PATCH] " syzbot
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Chuck Lever @ 2026-09-07 19:15 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, linux-nfs, netdev, syzkaller-bugs
On 9/7/26 1:44 PM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: df2908090cda Linux 7.3-rc2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=1416cc8e580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
> dashboard link: https://syzkaller.appspot.com/bug?extid=d5c77cabf7a3492aa650
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14daa071580000
The fix is already queued in nfsd-testing:
https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/commit/?id=8e5890ef0296
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git nfsd-testing
--
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
2026-09-07 17:44 [syzbot] [nfs?] [net?] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall syzbot
2026-09-07 19:15 ` Chuck Lever
@ 2026-09-14 12:05 ` syzbot
2026-09-15 1:38 ` syzbot
2026-09-17 1:27 ` syzbot
3 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-09-14 12:05 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git df2908090cda368b01ff43709f51890076c56157
Reported-by: syzbot+d5c77cabf7a3492aa650@syzkaller.appspotmail.com
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index d513971fb..90d356e1f 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -647,6 +647,7 @@ struct cld_upcall {
struct list_head cu_list;
struct cld_net *cu_net;
struct completion cu_done;
+ struct rpc_pipe_msg cu_msg;
union {
struct cld_msg_hdr cu_hdr;
struct cld_msg cu_msg;
@@ -658,22 +659,22 @@ static int
__cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
{
int ret;
- struct rpc_pipe_msg msg;
struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_u);
+ struct rpc_pipe_msg *msg = &cup->cu_msg;
- memset(&msg, 0, sizeof(msg));
- msg.data = cmsg;
- msg.len = nn->client_tracking_ops->msglen;
+ memset(msg, 0, sizeof(*msg));
+ msg->data = cmsg;
+ msg->len = nn->client_tracking_ops->msglen;
- ret = rpc_queue_upcall(pipe, &msg);
+ ret = rpc_queue_upcall(pipe, msg);
if (ret < 0) {
goto out;
}
wait_for_completion(&cup->cu_done);
- if (msg.errno < 0)
- ret = msg.errno;
+ if (msg->errno < 0)
+ ret = msg->errno;
out:
return ret;
}
@@ -806,7 +807,14 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
cup = NULL;
spin_lock(&cn->cn_lock);
list_for_each_entry(tmp, &cn->cn_list, cu_list) {
- if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid) {
+ /*
+ * Only match upcalls that userspace has already read.
+ * Otherwise the upcall's rpc_pipe_msg would still be queued
+ * when the caller resumes and frees it, leaving a dangling
+ * list entry that corrupts the next upcall queued here.
+ */
+ if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid &&
+ rpc_msg_is_inflight(&tmp->cu_msg)) {
cup = tmp;
if (status != -EINPROGRESS)
list_del_init(&cup->cu_list);
@@ -834,9 +842,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
static void
cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
{
- struct cld_msg *cmsg = msg->data;
- struct cld_upcall *cup = container_of(cmsg, struct cld_upcall,
- cu_u.cu_msg);
+ struct cld_upcall *cup = container_of(msg, struct cld_upcall, cu_msg);
/* errno >= 0 means we got a downcall */
if (msg->errno >= 0)
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
2026-09-07 17:44 [syzbot] [nfs?] [net?] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall syzbot
2026-09-07 19:15 ` Chuck Lever
2026-09-14 12:05 ` Forwarded: [PATCH] " syzbot
@ 2026-09-15 1:38 ` syzbot
2026-09-17 1:27 ` syzbot
3 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-09-15 1:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+d5c77cabf7a3492aa650@syzkaller.appspotmail.com
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index d513971fb..90d356e1f 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -647,6 +647,7 @@ struct cld_upcall {
struct list_head cu_list;
struct cld_net *cu_net;
struct completion cu_done;
+ struct rpc_pipe_msg cu_msg;
union {
struct cld_msg_hdr cu_hdr;
struct cld_msg cu_msg;
@@ -658,22 +659,22 @@ static int
__cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
{
int ret;
- struct rpc_pipe_msg msg;
struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_u);
+ struct rpc_pipe_msg *msg = &cup->cu_msg;
- memset(&msg, 0, sizeof(msg));
- msg.data = cmsg;
- msg.len = nn->client_tracking_ops->msglen;
+ memset(msg, 0, sizeof(*msg));
+ msg->data = cmsg;
+ msg->len = nn->client_tracking_ops->msglen;
- ret = rpc_queue_upcall(pipe, &msg);
+ ret = rpc_queue_upcall(pipe, msg);
if (ret < 0) {
goto out;
}
wait_for_completion(&cup->cu_done);
- if (msg.errno < 0)
- ret = msg.errno;
+ if (msg->errno < 0)
+ ret = msg->errno;
out:
return ret;
}
@@ -806,7 +807,14 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
cup = NULL;
spin_lock(&cn->cn_lock);
list_for_each_entry(tmp, &cn->cn_list, cu_list) {
- if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid) {
+ /*
+ * Only match upcalls that userspace has already read.
+ * Otherwise the upcall's rpc_pipe_msg would still be queued
+ * when the caller resumes and frees it, leaving a dangling
+ * list entry that corrupts the next upcall queued here.
+ */
+ if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid &&
+ rpc_msg_is_inflight(&tmp->cu_msg)) {
cup = tmp;
if (status != -EINPROGRESS)
list_del_init(&cup->cu_list);
@@ -834,9 +842,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
static void
cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
{
- struct cld_msg *cmsg = msg->data;
- struct cld_upcall *cup = container_of(cmsg, struct cld_upcall,
- cu_u.cu_msg);
+ struct cld_upcall *cup = container_of(msg, struct cld_upcall, cu_msg);
/* errno >= 0 means we got a downcall */
if (msg->errno >= 0)
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
2026-09-07 17:44 [syzbot] [nfs?] [net?] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall syzbot
` (2 preceding siblings ...)
2026-09-15 1:38 ` syzbot
@ 2026-09-17 1:27 ` syzbot
3 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-09-17 1:27 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: vmalloc-out-of-bounds Read in rpc_queue_upcall
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+d5c77cabf7a3492aa650@syzkaller.appspotmail.com
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index d513971fb..90abdea16 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -647,6 +647,7 @@ struct cld_upcall {
struct list_head cu_list;
struct cld_net *cu_net;
struct completion cu_done;
+ struct completion cu_msg_done;
union {
struct cld_msg_hdr cu_hdr;
struct cld_msg cu_msg;
@@ -671,6 +672,13 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
}
wait_for_completion(&cup->cu_done);
+ /*
+ * A downcall can be received before userspace reads the upcall. Wait
+ * for cld_pipe_destroy_msg() to signal that @msg has been removed from
+ * the rpc_pipe, so the on-stack message is not left linked in the pipe
+ * after this function returns.
+ */
+ wait_for_completion(&cup->cu_msg_done);
if (msg.errno < 0)
ret = msg.errno;
@@ -839,10 +847,15 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
cu_u.cu_msg);
/* errno >= 0 means we got a downcall */
- if (msg->errno >= 0)
- return;
+ if (msg->errno < 0)
+ complete(&cup->cu_done);
- complete(&cup->cu_done);
+ /*
+ * Signal __cld_pipe_upcall() that @msg is no longer queued. This is
+ * needed even when the downcall arrived first, otherwise the caller
+ * could return with the on-stack message still linked in the pipe.
+ */
+ complete(&cup->cu_msg_done);
}
static const struct rpc_pipe_ops cld_upcall_ops = {
@@ -979,6 +992,7 @@ alloc_cld_upcall(struct nfsd_net *nn)
}
}
init_completion(&new->cu_done);
+ init_completion(&new->cu_msg_done);
new->cu_u.cu_msg.cm_vers = nn->client_tracking_ops->version;
put_unaligned(cn->cn_xid++, &new->cu_u.cu_msg.cm_xid);
new->cu_net = cn;
^ permalink raw reply [flat|nested] 6+ messages in thread