From: Chuck Lever <chuck.lever@xxxxxxxxxx>
On Mon, 14 Apr 2025 22:38:52 +0800, Li Lingfeng wrote:
> In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through
> nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,
> this can cause NULL pointer dereference.
>
> Normally the delayed start of laundromat_work allows sufficient time for
> nfsd_ssc initialization to complete. However, when the kernel waits too
> long for userspace responses (e.g. in nfs4_state_start_net ->
> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->
> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the
> delayed work may start before nfsd_ssc initialization finishes.
>
> [...]
Applied to nfsd-testing, thanks!
[1/1] nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
commit: 05d68df60b9af7765c38073ff117169aa5f52310
--
Chuck Lever
