Linux kernel NFSv4 client: a delayed FREE_STATEID can use a freed nfs_server

Impact

If a FREE_STATEID operation is delayed for any reason, the struct nfs_server it references can be cleaned up while the call is still in flight, giving a use-after-free; the fix pins the object for the duration of the call. The reporter hit this in practice, and the record does not establish anything beyond a crash. GPU nodes routinely mount NFS for datasets, checkpoints and home directories, so the blast radius is a node panic during mount teardown or server trouble, which on a collective training job means every rank restarts from the last checkpoint.

Who can reach it

No authentication story - this is a normal NFSv4 client code path. Reaching it needs a FREE_STATEID that is delayed, which in practice means a slow, wedged or hostile NFS server, concurrent with teardown of the mount. Whoever operates the NFS server is in a position to create that timing.

What to do

Update to a stable kernel carrying the refcount fix and reboot; the NFS client is in-kernel, so there is no daemon to restart. Because this shows up around mount teardown and server stalls, the practical interim is keeping NFS servers healthy and avoiding forced unmounts under load - it does not remove the race.

References

Related entries

• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-005-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictor: AMD's L1D way predictor hashes virtual addresses to predict whichNCVD-2020-001-amd-zen-1-zen-zen-2-l1d-cache-wa · AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictorUnscored