Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthread

Impact

Several lifetime bugs in the async server-side COPY path let a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) race the copy kthread: the copy stays on clp->async_copies while refcounted, so release_copy_files() can run concurrently and double-put the nfsd_file; the STOPPED flag was set before the kthread's last dereferences of copy->nf_dst; copy_task was never pinned across kthread_stop(); and the embedded callback could outlive the copy. The result is use-after-free of nfsd_file and task_struct memory inside the kernel of the file server. A client that issues COPY and then OFFLOAD_CANCEL drives the race remotely, which on a storage node backing a GPU fleet means a kernel crash or worse for every job holding that mount.

Who can reach it

Any client that can mount the export and issue NFSv4.2 COPY plus OFFLOAD_CANCEL, subject to normal export authentication. Also reachable during export teardown on the server itself.

What to do

Upgrade to a stable kernel with the referenced commits and reboot the NFS server; the fix is in-kernel, so drain or fail over clients first. As an interim measure, exports served without NFSv4.2 async COPY (clients not using server-side copy) do not exercise this path. No fixed release numbers appear in the record.

References

Related entries

• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-005-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictor: AMD's L1D way predictor hashes virtual addresses to predict whichNCVD-2020-001-amd-zen-1-zen-zen-2-l1d-cache-wa · AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictorUnscored