syzbot keeps landing in nfsd_nl_listener_set_doit(), where a stall under
nfsd_mutex blocks every other NFSD netlink op. This is hardening rather than
a fix for any one report: it narrows what userland can push into that path
and shortens the worst stalls.
1: reject transport names NFSD cannot instantiate, before nfsd_mutex is
taken
2: cap a listener_set request at 1024 entries
3: stop svc_register() losing a registration error to a later program
4: bound the local rpcbind client to a single 1s attempt
5: report listener creation failures through extack
6: listener_set validation tests
7: a per-netns rpcbind stub, and the listener round-trip tests
Measured against a local rpcbind that accepts the connection and never
replies. The wait is paid per listener, since svc_xprt_create_from_sa()
passes flags of 0 and every listener therefore calls svc_register():
per rpcbind call 10s AF_LOCAL, 60s loopback TCP -> 1s
per listener 20s / 120s -> 2s
entries/request bounded only by message size -> 1024
worst request unbounded -> ~34min
Three things this does not do:
- "rdma" is still accepted, so 1024 entries can still mean 1024
request_module("svcrdma") upcalls under nfsd_mutex where svcrdma is
unavailable. Not counted above.
- write_ports() reaches the same code with the same mutex held. It is
legacy, so it is left alone.
- ~34min is still ~17x the hung-task threshold, so the reproducer should be
expected to keep tripping the watchdog. The durable fix is to make rpcbind
registration asynchronous so those RPCs stop running under nfsd_mutex at
all. That needs behavioural changes we should discuss first, so it is a
separate patchset.
Patch 3 is a flag day for CONFIG_NFS_LOCALIO=y: a registration failure now
aborts listener creation there too, matching CONFIG_NFS_LOCALIO=n. Details
in that patch.
Please consider these for v7.4.
Signed-off-by: Jeff Layton <[email protected]>
---
Jeff Layton (7):
NFSD: validate transport name in listener_set before serv creation
NFSD: cap the number of listeners accepted in listener_set
SUNRPC: keep the first error in svc_register()
SUNRPC: bound the local rpcbind client timeout to 1s
NFSD: report listener creation failures through extack
selftests/nfsd: exercise listener_set request validation
selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
fs/nfsd/nfsctl.c | 42 +-
net/sunrpc/rpcb_clnt.c | 12 +
net/sunrpc/svc.c | 9 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/nfsd/.gitignore | 1 +
tools/testing/selftests/nfsd/Makefile | 6 +
tools/testing/selftests/nfsd/config | 4 +
.../testing/selftests/nfsd/nfsd_netlink_listener.c | 920 +++++++++++++++++++++
tools/testing/selftests/nfsd/settings | 1 +
9 files changed, 987 insertions(+), 9 deletions(-)
---
base-commit: 0b6d2c7e3abca8d17fddeecb6e4c32a8438ec2fb
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a
Best regards,
--
Jeff Layton <[email protected]>
