[PATCH v5 00/15] nfsd/sunrpc: harden the netlink listener set interface

Jeff Layton posted 15 patches 3 weeks, 3 days ago
MAINTAINERS                                        |    1 +
fs/nfsd/nfsctl.c                                   |   96 +-
include/linux/sunrpc/clnt.h                        |    3 +-
include/linux/sunrpc/svc.h                         |    7 +-
net/sunrpc/rpcb_clnt.c                             |   38 +-
net/sunrpc/svc.c                                   |   67 +-
net/sunrpc/svc_xprt.c                              |   21 +
tools/testing/selftests/Makefile                   |    1 +
tools/testing/selftests/nfsd/.gitignore            |    1 +
tools/testing/selftests/nfsd/Makefile              |    6 +
tools/testing/selftests/nfsd/config                |   14 +
.../testing/selftests/nfsd/nfsd_netlink_listener.c | 1323 ++++++++++++++++++++
tools/testing/selftests/nfsd/settings              |    1 +
13 files changed, 1558 insertions(+), 21 deletions(-)
[PATCH v5 00/15] nfsd/sunrpc: harden the netlink listener set interface
Posted by Jeff Layton 3 weeks, 3 days ago
This version just fixes up some errno handling confusion that was in v3
that Chuck pointed out. This version also drops ENAVAIL as a special
error code -- we can use EIO for that instead.

Please consider these for v7.4.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Changes in v5 (all from the Sashiko review of v4):
- svc_xprt_clear_rpcb_unreg(): only clear listeners already marked for
  close, instead of every permsock in the net
- svc_register(): stop the version loop as soon as rpcbind goes quiet,
  even when vs_rpcb_optnl discarded the error
- listener_set: only blame rpcbind in the extack for the entry that
  actually hit it
- rpcb_register_call(): -ERESTARTSYS is not a "never reached the wire"
  case; the task can be signalled after RPC_TASK_SENT
- Tests: use linux/nfsd_netlink.h rather than open-coded ids, skip when
  the loopback ioctls fail, add NFSD's Kconfig deps to the fragment
- New patch: rpcb_register_inet{4,6}() NULL-deref when
  rpc_sockaddr2uaddr() fails
- Link to v4: https://lore.kernel.org/r/20260831-nfsd-nl-hang-v4-0-0f4e89139409@kernel.org

Changes in v4:
- Use EIO instead of ENAVAIL to represent an unrecoverable rpcbind error
- Link to v3: https://lore.kernel.org/r/20260828-nfsd-nl-hang-v3-0-55026685c75d@kernel.org

Changes in v3:
- Dropped v2's patch 4, the svc_register() unwind. rpcbind matches an UNSET
  on [program, version, netid], and the v2 fallback ignores the protocol
  completely. The unwind could therefore clear entries that belong to other
  live listeners. Chuck Lever found that.
- A failed registration stays fatal. Patch 3 makes CONFIG_NFS_LOCALIO=y
  agree with CONFIG_NFS_LOCALIO=n on that point.
- Tests: sem_register_refused now reads the listener set back, because
  -EACCES alone does not show that no listener was created.
  sem_create_failure_extack is new. The netlink socket now asks for
  NETLINK_EXT_ACK and NETLINK_CAP_ACK, so that a test can read the extack.
- Tests: FIXTURE_TEARDOWN removes any listener or thread that a test left
  behind. Those pinned the netns.
- Stop attempting to register any more listeners when the first
  svc_register() call fails.
- Bound the unregistration side the same way. svc_register(),
  svc_unregister() and the per-listener teardown in svc_delete_xprt() all
  give up once the local rpcbind stops answering, so one listener_set pays
  one timeout in each direction rather than one per listener.
- Link to v2: https://lore.kernel.org/r/20260811-nfsd-nl-hang-v2-0-c0c92b3953c3@kernel.org

Changes in v2:
- New patch 4: when a later registration failed, svc_register() left the
  entries that it had already set in rpcbind. Those entries pointed at a
  port that the caller then closed.
- Tests: behavioural fixes for several tests. Several assertions checked
  only an errno that both the fixed kernel and the broken kernel return.
  val_bad_transport() now also requires that the rpcbind stub saw no
  traffic. val_second_entry_bad() requires that no listener started.
  func_empty_destroys requires that the kernel dropped the local rpcbind
  client and then connected again. The two -EBUSY tests require that the
  listener set does not change. find_listener() now matches the address
  too.
- Tests: the stub read the revents of a newly accepted pollfd that poll()
  had not written. The stub could therefore start a blocking read with no
  readiness event.
- Tests: the config fragment now includes NAMESPACES, SHMEM, TMPFS and
  UNIX. Without them, every test skipped.
- Link to v1: https://lore.kernel.org/r/20260810-nfsd-nl-hang-v1-0-2519fdd5bc1a@kernel.org

---
Jeff Layton (15):
      NFSD: cap the number of listeners accepted in listener_set
      NFSD: validate transport name in listener_set before serv creation
      SUNRPC: keep the first error in svc_register()
      SUNRPC: bound the local rpcbind client timeout to 1s
      NFSD: report listener creation failures through extack
      SUNRPC: report local rpcbind calls that get no answer
      SUNRPC: stop svc_register() once rpcbind stops answering
      SUNRPC: stop the svc_unregister() sweep once rpcbind stops answering
      SUNRPC: stop unregistering listeners once rpcbind stops answering
      NFSD: stop registering with rpcbind after a failure in listener_set
      SUNRPC: check rpc_sockaddr2uaddr() for failure when registering
      selftests/nfsd: exercise listener_set request validation
      selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
      selftests/nfsd: check that listener_set asks rpcbind once
      selftests/nfsd: check that listener removal asks rpcbind once

 MAINTAINERS                                        |    1 +
 fs/nfsd/nfsctl.c                                   |   96 +-
 include/linux/sunrpc/clnt.h                        |    3 +-
 include/linux/sunrpc/svc.h                         |    7 +-
 net/sunrpc/rpcb_clnt.c                             |   38 +-
 net/sunrpc/svc.c                                   |   67 +-
 net/sunrpc/svc_xprt.c                              |   21 +
 tools/testing/selftests/Makefile                   |    1 +
 tools/testing/selftests/nfsd/.gitignore            |    1 +
 tools/testing/selftests/nfsd/Makefile              |    6 +
 tools/testing/selftests/nfsd/config                |   14 +
 .../testing/selftests/nfsd/nfsd_netlink_listener.c | 1323 ++++++++++++++++++++
 tools/testing/selftests/nfsd/settings              |    1 +
 13 files changed, 1558 insertions(+), 21 deletions(-)
---
base-commit: e247236b7ffa1e0940f834787feade8570c5db91
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>
Re: [PATCH v5 00/15] nfsd/sunrpc: harden the netlink listener set interface
Posted by Chuck Lever 3 weeks, 2 days ago
On Tue, 01 Sep 2026 09:39:38 -0400, Jeff Layton wrote:
> This version just fixes up some errno handling confusion that was in v3
> that Chuck pointed out. This version also drops ENAVAIL as a special
> error code -- we can use EIO for that instead.
> 
> Please consider these for v7.4.
> 
> 
> [...]

Applied to nfsd-testing, thanks!

[01/15] NFSD: cap the number of listeners accepted in listener_set
        commit: 196e48772ea60dc35adf57341e09e4bdf8f4212c
[02/15] NFSD: validate transport name in listener_set before serv creation
        commit: 85d7bca4afc7db07cedb612457fda195468cdb2d
[03/15] SUNRPC: keep the first error in svc_register()
        commit: d6c53650eb4aea422e6cf18b99428ff314ae7dd2
[04/15] SUNRPC: bound the local rpcbind client timeout to 1s
        commit: a607970b7003acf07157aae2f4c928af92b175d8
[05/15] NFSD: report listener creation failures through extack
        commit: 9dbaebcec682cc4c032c7a24ca4f04bdde287935
[06/15] SUNRPC: report local rpcbind calls that get no answer
        commit: f8ee183cb6123784cb4ffc2facb309d17bc896e9
[07/15] SUNRPC: stop svc_register() once rpcbind stops answering
        commit: 53fbfe00e9615496002b7e045b681fed45006634
[08/15] SUNRPC: stop the svc_unregister() sweep once rpcbind stops answering
        commit: 1ef5f3076a52482510c5afd4e816db33599f1341
[09/15] SUNRPC: stop unregistering listeners once rpcbind stops answering
        commit: e3d28a4c7f71946635ff6900aad6876e87332aa4
[10/15] NFSD: stop registering with rpcbind after a failure in listener_set
        commit: ce39bbabbe205b50b66ac935bd54036d86d86ba3
[11/15] SUNRPC: check rpc_sockaddr2uaddr() for failure when registering
        commit: 3349f8b6b9a938405275c232cf441fbff23d61b5
[12/15] selftests/nfsd: exercise listener_set request validation
        commit: 213294f2e2548c6d837cbc55ba0731c90a7a45e2
[13/15] selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
        commit: 61222d2dca7b03ecd3a590afed804f2324f4df82
[14/15] selftests/nfsd: check that listener_set asks rpcbind once
        commit: 3c9de315b3f85a67b4c54650c28ead94faad726f
[15/15] selftests/nfsd: check that listener removal asks rpcbind once
        commit: f56be2f4966b31fd60c379a30d8c83e89db7bc62

--
Chuck Lever