From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f42.google.com (mail-ot1-f42.google.com [209.85.210.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C61837E2FC for ; Fri, 10 Apr 2026 15:09:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775833774; cv=none; b=A7eDa3ojYzvLxJleZKCwe8WHJRJnVkWGQNMxmoS4gxoFYmSDA16SGYz44hfXmXZ59hISjULJRDj5CBAiwzQJHMjAbozLlQaEGqH0iHyvuA1qewzQLq0cwDql8N0YluXMh1wFi4t6oMFbZDIoKCsQ823d5ZkT7ppNlUzW+boHAdk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775833774; c=relaxed/simple; bh=MkTiXa4ZLMwa46vHWDYneQN8G9FUNN7jl3S9y9UsRM0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mDmuEKFixa3frwix8NsY/STwHAjs1DyV1O5Rc0xqxbTEiRn3S92j7+LPJ9v9bcRujmmdBuBsuN4f70UAJbvkT0qHx2WtzKktL/rHUAx+fSz807UAMUESYlssmycmzdVCIHYKQjB6YqiROUKuCNzyXj51ubeihUob49A3DIXiWGo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=hammerspace.com; spf=pass smtp.mailfrom=hammerspace.com; dkim=pass (2048-bit key) header.d=hammerspace.com header.i=@hammerspace.com header.b=mv8FUelo; arc=none smtp.client-ip=209.85.210.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=hammerspace.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=hammerspace.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=hammerspace.com header.i=@hammerspace.com header.b="mv8FUelo" Received: by mail-ot1-f42.google.com with SMTP id 46e09a7af769-7d1872504cbso1940702a34.0 for ; Fri, 10 Apr 2026 08:09:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hammerspace.com; s=google; t=1775833771; x=1776438571; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=5n0ZBmxoxfXnsx2VGqrnP+0O10rmsKiHDOB93FnsPoM=; b=mv8FUelod/SmZsheQsVJgLMv6numkez5+MwJ5VPLxTfR7Z2oEs7QhWH+7TPqHp5wQc uYQm0TPprI4V9YeF4htQnmCEK3GNi04Lmsr3KGc+LehBb0nwmvshGuyzzA4Fv95p9wD7 2eGDxi4OowPSVWHhssHLNNYPasnDOporEaNW72cxgIXPrxnvzSeU16dEWHjoD1GMMyT/ eI6WgfbBQAs4qWbnrO6XRb/a3w070bqjdHQ3E3HQm3svRrA58TxaihV0D/gRVZGR7m06 cI+YI+OIajJkUGyttcA5O90752cvzR529MvqL0pp3HhkN6lKK6o7kN8QLsSOhIehggx/ I7MQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775833771; x=1776438571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=5n0ZBmxoxfXnsx2VGqrnP+0O10rmsKiHDOB93FnsPoM=; b=dEuWGJ+DxKXu8E2tlJOS8fvSU1IeJLGnU0Avow0M/mqobIqZgR7PyXuePoJqF7+Byr HhC3+Fzp5xm6kHgV/rUH60WAxzYTw+C2R07k2t8STTY5fGpzK/FEYB49VjaZ5+KtzZs8 HGXcGK/ynhGzHUwPXBtgyas6ikA8Ja/nCmeQSYXuSc8J9nxjZdNqRWUT7QfLA4X1+l58 cYW5iXBm5Feme2mDGbK7EnDOlj8+EdGNTwDrCU6v+Rtoy+d+ATbjlgjC+6rD0ccegUwi wXsB/039oHL0Gbci/XxeFSyYIf0kvcX5f6vPJ4rbDyRFfL36DlXCGYpL9aL1XpBQMVCJ Db+g== X-Forwarded-Encrypted: i=1; AJvYcCWtu+CweHbv8sVQmCC2xjxa5bS6pYFEAXlJGW/hjx35tiYSY/ImqpYtTgaBv7YT9Ph7ttFA0CKbeCnx1Yk=@vger.kernel.org X-Gm-Message-State: AOJu0YyGx/Upc8gXbyaT6zLfuLrASaTYmfm6e2fs4nfar00BCKSsaHC2 lIh22j5xx1SoqxURXdhEOxymuVIdsXDXt++C3jCoKNWP87HMbyG8LBfXrA+sB5bZcwk= X-Gm-Gg: AeBDiesfXqnFKretpI89B09a7Q12e2wqH1J5+C6zSEgIunOaoXYc+eNNiUgUEa44OiL 5zUw4hWSdgzpcNgYp4MpR3kSjqML6l/Rs/U7uXp67TWTAryLGBbiiYU7v2cBQN7mrk8fA1xsUpP lVCfx+t5CaE+f/SgQP7w09DYGr5EMcfLpcDHLTRLNOuGRWmh3gBpzyHR9YLCDskT7RpTJUonkyO vVt/zyBC8GTAgebLoJ3d7I25Bkgn0XPzkPn3VT9ggxXkujtMc7z+1uFt6KckCm/R9Wjf8IWwCpL QB54APymm8mVgbz2emeJ0GgbFXEY9pO9O6M11KUlL68wz+/wiQ2mNFcl6SbIj/tMV229PUNOiqM NOo5Zp78BRDpW14vbmef1zxSc0/vDXd72+b/s2+O+T5DG2W/vBPZAVWDbecjC13vRoQ4meB4Iv5 QnVw8IErsJkmMtwymeOY5WKZVJwtLcxKESPYT2k+QIPw0= X-Received: by 2002:a05:6830:7207:b0:7dc:807:d1f3 with SMTP id 46e09a7af769-7dc1762dacdmr3033904a34.7.1775833771209; Fri, 10 Apr 2026 08:09:31 -0700 (PDT) Received: from [192.168.254.51] ([66.97.168.37]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7dc2d18a063sm1067552a34.1.2026.04.10.08.09.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Apr 2026 08:09:30 -0700 (PDT) From: Benjamin Coddington X-Google-Original-From: Benjamin Coddington To: Sean Chang Cc: trondmy@kernel.org, anna@kernel.org, linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v1 1/2] NFS: fix RCU safety in nfs_compare_super_address Date: Fri, 10 Apr 2026 11:09:29 -0400 X-Mailer: MailMate (2.0r6272) Message-ID: In-Reply-To: <20260408161428.155169-2-seanwascoding@gmail.com> References: <20260408161428.155169-1-seanwascoding@gmail.com> <20260408161428.155169-2-seanwascoding@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 8 Apr 2026, at 12:14, Sean Chang wrote: > The cl_xprt pointer in struct rpc_clnt is marked as __rcu. Accessing > it directly in nfs_compare_super_address() without RCU protection is > unsafe and triggers Sparse warnings about dereferencing noderef > expressions. > > Fix this by wrapping the access with rcu_read_lock() and using > rcu_dereference() to safely retrieve the transport pointer. This > ensures the xprt remains valid during the comparison of network > namespaces and addresses, preventing potential use-after-free during > concurrent transport updates. > > Signed-off-by: Sean Chang Fixes: 7e3fcf61abde ("nfs: don't share mounts between network namespaces"= ) > --- > fs/nfs/super.c | 32 ++++++++++++++++++++++---------- > 1 file changed, 22 insertions(+), 10 deletions(-) > > diff --git a/fs/nfs/super.c b/fs/nfs/super.c > index 7a318581f85b..071337f9ea37 100644 > --- a/fs/nfs/super.c > +++ b/fs/nfs/super.c > @@ -1166,43 +1166,55 @@ static int nfs_set_super(struct super_block *s,= struct fs_context *fc) > static int nfs_compare_super_address(struct nfs_server *server1, > struct nfs_server *server2) > { > + struct rpc_xprt *xprt1, *xprt2; > struct sockaddr *sap1, *sap2; > - struct rpc_xprt *xprt1 =3D server1->client->cl_xprt; > - struct rpc_xprt *xprt2 =3D server2->client->cl_xprt; > + int ret =3D 0; > + > + rcu_read_lock(); > + > + xprt1 =3D rcu_dereference(server1->client->cl_xprt); > + xprt2 =3D rcu_dereference(server2->client->cl_xprt); > + > + if (!xprt1 || !xprt2) > + goto out; ^^ I'm not sure that's a great test, the rpc_xprt objects are refcounted.= These might not be null but you could still race with a freeing path? However, I think you might just be safe inside the RCU section here becau= se rpc_switch_client_transport() uses synchronize_rcu() before xprt_put(old)= =2E I didn't audit all the freeing paths. > if (!net_eq(xprt1->xprt_net, xprt2->xprt_net)) > - return 0; > + goto out; Probably safe to drop the RCU protection scope after this point. No need= to hold it over all the other checks.. Ben > > sap1 =3D (struct sockaddr *)&server1->nfs_client->cl_addr; > sap2 =3D (struct sockaddr *)&server2->nfs_client->cl_addr; > > if (sap1->sa_family !=3D sap2->sa_family) > - return 0; > + goto out; > > switch (sap1->sa_family) { > case AF_INET: { > struct sockaddr_in *sin1 =3D (struct sockaddr_in *)sap1; > struct sockaddr_in *sin2 =3D (struct sockaddr_in *)sap2; > if (sin1->sin_addr.s_addr !=3D sin2->sin_addr.s_addr) > - return 0; > + goto out; > if (sin1->sin_port !=3D sin2->sin_port) > - return 0; > + goto out; > break; > } > case AF_INET6: { > struct sockaddr_in6 *sin1 =3D (struct sockaddr_in6 *)sap1; > struct sockaddr_in6 *sin2 =3D (struct sockaddr_in6 *)sap2; > if (!ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr)) > - return 0; > + goto out; > if (sin1->sin6_port !=3D sin2->sin6_port) > - return 0; > + goto out; > break; > } > default: > - return 0; > + goto out; > } > > - return 1; > + ret =3D 1; > + > +out: > + rcu_read_unlock(); > + return ret; > } > > static int nfs_compare_userns(const struct nfs_server *old, > -- = > 2.34.1