decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so
each referring_call_list starts uninitialized. decode_rc_list() assigns
rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero
referring calls therefore leaves the pointer uninitialized, and
nfs4_callback_sequence() later passes it to kfree(). KASAN reports a
double free in nfs_cb_sequence_empty_refcalls_test().

Initialize the pointer before decoding the list.

Fixes: 4aece6a19cf7 ("nfs41: cb_sequence xdr implementation")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 fs/nfs/callback_xdr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 4382baddc9ee..5857f57f0644 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -360,6 +360,7 @@ static __be32 decode_rc_list(struct xdr_stream *xdr,
 	int i;
 	__be32 status;
 
+	rc_list->rcl_refcalls = NULL;
 	status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
 	if (status)
 		goto out;
-- 
2.47.3

Hi Jeremy,

On Mon, Aug 17, 2026, at 5:16 PM, Jérémy Jean wrote:
> decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so
> each referring_call_list starts uninitialized. decode_rc_list() assigns
> rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero
> referring calls therefore leaves the pointer uninitialized, and
> nfs4_callback_sequence() later passes it to kfree(). KASAN reports a
> double free in nfs_cb_sequence_empty_refcalls_test().
>
> Initialize the pointer before decoding the list.
>
> Fixes: 4aece6a19cf7 ("nfs41: cb_sequence xdr implementation")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  fs/nfs/callback_xdr.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
> index 4382baddc9ee..5857f57f0644 100644
> --- a/fs/nfs/callback_xdr.c
> +++ b/fs/nfs/callback_xdr.c
> @@ -360,6 +360,7 @@ static __be32 decode_rc_list(struct xdr_stream *xdr,
>  	int i;
>  	__be32 status;
> 
> +	rc_list->rcl_refcalls = NULL;

I think I would rather have this initialized to NULL from the beginning.
Could you instead update decode_cb_sequence_args() to use kzalloc_objs()
when allocating the referring_call_lists?

Thanks,
Anna

>  	status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
>  	if (status)
>  		goto out;
> -- 
> 2.47.3