Linux kernel nfsd: NFSEXP_PNFS not checked when exports are configured over netlink

Impact

When the block-layout checks in nfsd were reworked, the NFSEXP_PNFS test moved out of nfsd4_setup_layout_type() into its callers, and the new netlink call site was not updated. The result is that the pNFS export flag is not honoured on exports configured through the netlink interface, so the layout type an export offers does not match what the administrator asked for. For an NFS server fronting shared storage for a GPU fleet, pNFS block layouts hand clients direct access to the backing device, so an export flag that is not enforced is a storage access-control question rather than a cosmetic one. The record is a one-paragraph stable-tree fix: it does not state which direction the mishandling goes, does not carry a CVSS score, and does not claim demonstrated unauthorised access. Servers that configure exports only through exportfs and /etc/exports are not on the affected codepath.

Who can reach it

Reachable by NFS clients of an affected export - anyone on the storage network who can mount it - but only on servers whose exports are configured through nfsd's netlink interface. No authentication beyond whatever the export itself requires.

What to do

Take the stable kernel update that restores the NFSEXP_PNFS check in the netlink path on your NFS servers, then restart nfsd or reboot the server; a kernel update to nfsd in practice means draining NFS clients or scheduling a server reboot. Until then, confirm which exports advertise block layouts and whether your tooling uses the netlink export path at all. The record names only the two stable commits, not a fixed release version.

References

Related entries

• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-005-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictor: AMD's L1D way predictor hashes virtual addresses to predict whichNCVD-2020-001-amd-zen-1-zen-zen-2-l1d-cache-wa · AMD Zen 1 / Zen+ / Zen 2 - L1D cache way predictorUnscored