kernel/git/ath/ath.git/fs/lockd, branch main

lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()

2026-06-09T20:32:59Z

file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") set .pc_argzero to zero for the converted procedures and moved file-handle population into nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes into lock->fh.data. When an NLMv4 client presents a file handle shorter than LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument buffer held from an earlier request. The same wire handle then hashes to different buckets across calls; nlm_lookup_file() misses the existing nlm_file entry, and lock-state lookups fail. Zero only the tail bytes that file_hash() would otherwise consume. Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte that file_hash() reads. Reported-by: Jeff Layton Closes: https://lore.kernel.org/r/5229a9746d723a3f830120c0b966510f75badfc2.camel@kernel.org Fixes: 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure") Signed-off-by: Chuck Lever

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

2026-06-09T20:32:59Z

The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever

lockd: Plug nlm_file leak when nlm_do_fopen() fails

2026-06-09T20:32:59Z

A client can repeatedly drive nlm_do_fopen() failures by presenting file handles that the underlying export rejects. After kzalloc_obj() succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps to out_unlock, which releases nlm_file_mutex and returns without freeing the allocation, so each failure leaks one nlm_file. Route the failure through out_free so kfree() runs before the function returns. Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever

lockd: Unify cast_status

2026-06-09T20:32:59Z

cast_status folds internal lock-daemon sentinels into NLMv1/v3 wire status codes for the v3 reply path. Two variants have existed since the original kernel import: a strict allowlist under CONFIG_LOCKD_V4 and a sentinel-translation form for the !CONFIG_LOCKD_V4 build. The split was never grounded in a behavioural difference -- nlmsvc_testlock and nlmsvc_lock, which feed cast_status, return the same set of values in both configurations -- and recent xdrgen conversions have narrowed the caller set further: nlm__int__stale_fh and nlm__int__failed are now translated at their point of origin in nlm3svc_lookup_file, and the cast_status wraps around nlmsvc_cancel_blocked and nlmsvc_unlock have been dropped because those functions return only wire codes. Collapse the two variants into one. The unified form keeps the CONFIG_LOCKD_V4 arm's allowlist, retains the nlm__int__deadlock translation, and folds anything else to nlm_lck_denied_nolocks after a pr_warn_once so an unexpected sentinel from a future refactor remains visible in the kernel log instead of being silently passed to the wire encoder. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Remove dead code from fs/lockd/xdr.c

2026-06-09T20:32:59Z

All NLMv3 server-side procedures now dispatch through xdrgen-generated encoder and decoder functions, leaving the hand-written XDR processing in fs/lockd/xdr.c with no remaining callers. Remove fs/lockd/xdr.c, the fs/lockd/svcxdr.h header it included, the Makefile entry, and the now-unused nlmsvc_decode_* / nlmsvc_encode_* prototypes from fs/lockd/xdr.h. The structure definitions and status code macros in xdr.h are retained as they are still used by the client-side code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Remove C macros that are no longer used

2026-06-09T20:32:59Z

The conversion of all NLMv3 procedures to xdrgen-generated XDR functions is complete. The hand-rolled XDR size calculation macros (Ck, No, St, Rg) and the nlm_void structure definition served only the older implementations and are now unused. Also removes NLMDBG_FACILITY, which was set to the client debug flag in server-side code but never referenced, and corrects a comment to specify "NLMv3 Server procedures". Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Use xdrgen XDR functions for the NLMv3 FREE_ALL procedure

2026-06-09T20:32:59Z

With all other NLMv3 procedures now converted to xdrgen-generated XDR functions, the FREE_ALL procedure can be converted as well. This conversion allows the removal of nlmsvc_retrieve_args(), a 52-line helper function that was used only by FREE_ALL to retrieve client information from lockd's internal data structures. Replace the NLMPROC_FREE_ALL entry in the nlmsvc_procedures array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is updated to use the new wrapper structure (nlm_notify_wrapper) and call nlm3svc_lookup_host() directly, eliminating the need for the now-removed helper function. Setting pc_argzero to zero is safe because the generated decoder fills the argp->xdrgen subfields before the procedure runs, so the zeroing memset performed by the dispatch layer is not needed. The nlm_notify_wrapper structure has no members beyond the xdrgen substructure, so no further initialization is required. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Use xdrgen XDR functions for the NLMv3 NM_LOCK procedure

2026-06-09T20:32:59Z

Now that nlmsvc_do_lock() has been introduced to handle both monitored and non-monitored lock requests, the NLMv3 NM_LOCK procedure can be converted to use xdrgen-generated XDR functions. This conversion allows the removal of __nlmsvc_proc_lock(), a helper function that was previously shared between the LOCK and NM_LOCK procedures. Replace the NLMPROC_NM_LOCK entry in the nlmsvc_procedures array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is reduced to a thin wrapper around nlmsvc_do_lock() with the monitored flag set to false. The pc_argzero=0 choice was justified for the LOCK conversion and applies unchanged here, since both procedures share the same nlm_lockargs_wrapper layout and decoder. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Use xdrgen XDR functions for the NLMv3 UNSHARE procedure

2026-06-09T20:32:59Z

Convert the NLMv3 UNSHARE procedure to use xdrgen-generated XDR functions nlm_svc_decode_nlm_shareargs and nlm_svc_encode_nlm_shareres. The procedure handler is updated to use the wrapper structures (nlm_shareargs_wrapper and nlm_shareres_wrapper) introduced by the SHARE conversion patch and accesses arguments through the argp->xdrgen hierarchy. The .pc_argzero field is set to zero because the generated decoder fills argp->xdrgen before the procedure runs, so the zeroing memset performed by the dispatch layer is no longer needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever

lockd: Use xdrgen XDR functions for the NLMv3 SHARE procedure

2026-06-09T20:32:59Z

Convert the NLMv3 SHARE procedure to use xdrgen-generated XDR functions nlm_svc_decode_nlm_shareargs and nlm_svc_encode_nlm_shareres. This patch introduces struct nlm_shareargs_wrapper and struct nlm_shareres_wrapper to bridge between the xdrgen-generated structures and the internal lockd types. The procedure handler is updated to access arguments through the argp->xdrgen hierarchy and uses nlm3svc_lookup_host and nlm3svc_lookup_file for host and file resolution. The .pc_argzero field is set to zero because the generated decoder fills argp->xdrgen before the procedure runs, so the zeroing memset performed by the dispatch layer is no longer needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever