Re: [PATCH 2/2] nfsd: check access to the export being entered when crossing mounts

["Chuck Lever" <cel@kernel.org>]

On Wed, Nov 4, 2026, at 6:56 AM, orkunsari via B4 Relay wrote:
> From: orkunsari <sariorkunemin@gmail.com>
>
> Commit f0d6ad5a2f67 ("nfsd: move check_nfsd_access() call into
> nfsd_cross_mnt()") moved the check_nfsd_access() calls from
> nfsd_lookup() and the NFSv4 READDIR encoder into nfsd_cross_mnt().  The
> moved call checks @exp, the export being left, which the caller has
> already verified, rather than @exp2, the export being entered.  The
> sec= and xprtsec= settings of a crossmnt/nohide child export are
> therefore no longer applied when LOOKUP or READDIR returns its root
> filehandle and attributes.  Later operations on that filehandle are
> still checked by fh_verify().
>
> The same commit also removed the check that nfsd_lookup() applied after
> a ".." lookup steps up into a parent export via nfsd_lookup_parent().
>
> Simply checking @exp2 instead is not enough: nfsd_lookup_dentry() also
> serves SECINFO, which must not fail with NFS4ERR_WRONGSEC (RFC 8881,
> section 2.6.3.1.1.5) and did not check the target export before.
>
> Split the crossing into __nfsd_cross_mnt(), which checks @exp2 before
> switching to it only when asked to.  nfsd_cross_mnt() keeps checking,
> for READDIR and the CREATE paths, while nfsd_lookup_dentry() does not.
> nfsd_lookup() checks the resulting export whenever it differs from the
> directory's, which covers both mount crossings and "..", as it did
> before.
>
> This was found by AI-assisted code review (Claude Code).  The fix has
> been build-tested with W=1 only; no reproducer was run.
>
> Fixes: f0d6ad5a2f67 ("nfsd: move check_nfsd_access() call into 
> nfsd_cross_mnt()")
> Signed-off-by: orkunsari <sariorkunemin@gmail.com>

This issue is very likely addressed by patches I posted earlier this
week in response to a similar vulnerability report.

  - "NFSD: Check the entered export on a mount crossing" checks the
    entered export inside nfsd_cross_mnt and in nfsd_lookup_parent,
    which covers the ".." case that 2/2 also raises.
  - "NFSD: Let SECINFO query an export that excludes the request's
    flavor" handles the SECINFO concern the patch solves with its
    __nfsd_cross_mnt split.
  - Two follow-ups (secure-port policy, applying the entered export's
    credentials after LOOKUP and RESTOREFH) rework the same region
    further.

Let's set 2/2 aside for now, because the series I posted seems more
thorough.


-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)