From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35AF53909BF for ; Sun, 31 May 2026 15:54:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780242890; cv=none; b=jzbTwWEZ2pmPeJ2Xe8TlZyHGFD4J3KeaO+cGwJaNscaa1G/lYrnnIrVaHAaswzZT+yDhPK17L0z5B3FZ3YMyYiyjuXcGoYibtcwHmJKdkdKFn5x4/lh+qHuRaff+CbzmA7dbRojPmak72QBy+vjn+FDEciDeMlSX3FWCpOWFNzI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780242890; c=relaxed/simple; bh=3i77uw0APEAMrftupDxLB6Ho0ELBcxUOB/DsANNtQ7g=; h=MIME-Version:Date:From:To:Cc:Message-Id:In-Reply-To:References: Subject:Content-Type; b=r3WwnKeogKYnDvldTGmkTjAcsOUyDbLK9lj2e0rkHUwWhBw+5nLbM6E7XG5fvZZHZGB/Y/r2J6W755fBYdAuYOoauxPNXVW6JsMRC7pav5zPUl72tlaeTZzdANzYqyDVTdA7JyRnfm3hOR31jtKWhHbHKibkgr8JFoLgleTki/M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mxzovd2G; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mxzovd2G" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91C801F00898; Sun, 31 May 2026 15:54:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780242889; bh=Tml65+TtYuBcIk7PFLN7B44qInGbVoSdDpEo3PWbrtY=; h=Date:From:To:Cc:In-Reply-To:References:Subject; b=mxzovd2GG6JTnB8FmaetfM+JkdOILHy2zJIQaFL5I3wvyi4u5LMQ/N8h70MF19boC lNIW2D9pYOTU+vGrEfHCl7a6SsqhC+yBrwkM3qzEVPLYQukT2W4KrJYipWNDc+NJBv SLXcqXS47rdnjY1KD5r+d5Nwr9MpMqf8tecZasx/v4uasOWMg4DvmaZ2dsc7PT0QW6 a1Yc3VII83Threfh3TFDAxHMnxQV8Y2+nPqiyirGOxdSoKzVWw019FCt0sSoEqak4Z SeBvfczFOsczqVsBhDNJ1rKxXBytQJ/RotslFeaSav5X3XbGb30cV9U73JoOuu/sKf qDzZHsK5t9c2g== Received: from phl-compute-10.internal (phl-compute-10.internal [10.202.2.50]) by mailfauth.phl.internal (Postfix) with ESMTP id 94FB7F40078; Sun, 31 May 2026 11:54:47 -0400 (EDT) Received: from phl-imap-15 ([10.202.2.104]) by phl-compute-10.internal (MEProxy); Sun, 31 May 2026 11:54:47 -0400 X-ME-Sender: X-ME-Proxy-Cause: dmFkZTFlhM5QdPgHincvFecyt9e49MnJ8qywG4rnJ9Lb61qIA98dwnSxYPS/AzgcRYySon C6c9onvVJ2efkHvx91b5rO9buH8Hn2tdElIBuyKj5Z29CL0PckJSZ28nto6NV47lrcR0cw JEryGlQE/oiD9N1bULUaGyrFjK2Txo8YA2TZJCf5hZU5e76x/9OOZh3vU5QknURL/TFJtG LPOqCMbo/vhsd0AcR8eZxLg9ZFHuKXOvfZ3v15QQvqPHwBDuV/A+d0YuI78oYOw8YIgoqM GLroDkZ49pVqubyKCPT2Ny7s4kBhgFIi8oOISN+J1SS5kyGCk630fqkeflEiuqPbN6p+BO SIeNoyUvyU1XfoZDyJfKvbkUsPK3LuvjUQKzj3jSvFivk46GryJtz1j6pPIM3CYlq49m18 sPLpsISu1GsLSzd4KlEauKjQYUdWpfW1jn8T5/aiTM0jnPxPkupKJT1MOG+AV8yonnGBr1 A9haNaKWZ4DLUwlQK+bSwZYVd13yixkydFG+TyKF/Do1lwpyPY192M7wOJOwxyR8mTQVVd iZUchieITiW2EehV2qAKRdWvM3OiPs2f9zU5I7OSdHnaTEMtcymwSwVSZFxE9JXGiNmZou jejjQyq+gWteEtPSamJ3TPPHW1t4g3Gn4rXYXa89i0JAq5xsoRaDfLJOXgJw X-ME-Proxy: Feedback-ID: ifa6e4810:Fastmail Received: by mailuser.phl.internal (Postfix, from userid 501) id 6E6D2780075; Sun, 31 May 2026 11:54:47 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ThreadId: AML-SSCfR-qs Date: Sun, 31 May 2026 11:54:26 -0400 From: "Chuck Lever" To: "Jeff Layton" , "Chuck Lever" , NeilBrown , "Olga Kornievskaia" , "Dai Ngo" , "Tom Talpey" , "David Howells" , "Alexander Viro" , "Rick Macklem" , "Chris Mason" Cc: linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org Message-Id: In-Reply-To: <20260531-nfsd-testing-v1-5-7bfa481b0540@kernel.org> References: <20260531-nfsd-testing-v1-0-7bfa481b0540@kernel.org> <20260531-nfsd-testing-v1-5-7bfa481b0540@kernel.org> Subject: Re: [PATCH 5/6] nfsd: release OPEN-decoded posix ACLs via op_release Content-Type: text/plain Content-Transfer-Encoding: 7bit On Sun, May 31, 2026, at 8:07 AM, Jeff Layton wrote: > From: Chris Mason > Remove the matching posix_acl_release() pair from nfsd4_open()'s > out_err: label: the compound dispatcher calls op_release > unconditionally after every op, [...] The double-free fix is right, but op_release is not called unconditionally after every op, and that gap leaks the ACLs on the v4.0 replay path. op_release runs only at the release: label inside nfsd4_encode_operation(). The compound loop skips that encoder on a replay: if (op->status == nfserr_replay_me) { nfsd4_encode_replay(resp->xdr, op); /* no op_release */ ... } else { nfsd4_encode_operation(resp, op); /* op_release here */ } So every ACL-bearing v4.0 OPEN retransmit leaks two posix_acl refs. Please release op->u on the replay branch too: if (op->status == nfserr_replay_me) { op->replay = &cstate->replay_owner->so_replay; nfsd4_encode_replay(resp->xdr, op); status = op->status = op->replay->rp_status; if (op->opdesc->op_release) op->opdesc->op_release(&op->u); } Let's fix the "unconditionally after every op" wording too. I've applied the other 5 in this series, so you can just resend this one. -- Chuck Lever