nfsd4_async_copy_reaper() detaches completed async copies from the client list and later calls cleanup_async_copy(), which eventually drops the stid reference via nfs4_put_stid(). That path accesses stid->sc_client unconditionally, but the client is not pinned during the cleanup phase. A concurrent expire_client() or force_expire_client() can free the client between the nn->client_lock drop and the cleanup loop, leaving nfs4_put_stid() with a stale sc_client pointer. This is the same missed pattern that Chuck Lever addressed in seven other nfsd4_laundromat() paths with cl_rpc_users pinning (v7.3-rc2). The async copy reaper was not covered by that series. Fix this by: 1. Skipping expired clients (cl_time == 0) during iteration. 2. Taking a cl_rpc_users reference before moving the copy to the reaplist. 3. Dropping the reference with put_client_no_renew() after cleanup_async_copy(). Export put_client_no_renew() so it is accessible from nfs4proc.c. Fixes: ac0514f4d198 ("NFSD: Add a laundromat reaper for async copy state") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- fs/nfsd/nfs4proc.c | 5 +++++ fs/nfsd/nfs4state.c | 2 +- fs/nfsd/state.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 50c07561e31f3..1f36afceb1fe1 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1501,6 +1501,9 @@ void nfsd4_async_copy_reaper(struct nfsd_net *nn) if (test_bit(NFSD4_COPY_F_OFFLOAD_DONE, ©->cp_copy.cp_flags)) { if (!--copy->cp_ttl) { + if (clp->cl_time == 0) + continue; + atomic_inc(&clp->cl_rpc_users); list_del_init(©->copies); list_add(©->copies, &reaplist); } @@ -1513,8 +1516,10 @@ void nfsd4_async_copy_reaper(struct nfsd_net *nn) while (!list_empty(&reaplist)) { copy = list_first_entry(&reaplist, struct nfsd4_async_copy, copies); + clp = copy->cp_stid.sc_client; list_del_init(©->copies); cleanup_async_copy(copy); + put_client_no_renew(clp); } } diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 9c4adf3110aea..10e864ca7407a 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -252,7 +252,7 @@ static void put_client_no_renew_locked(struct nfs4_client *clp) __put_client_locked(clp, false); } -static void put_client_no_renew(struct nfs4_client *clp) +void put_client_no_renew(struct nfs4_client *clp) { struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 2d00a411c6634..1d3a7e35bb9ff 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -918,6 +918,7 @@ extern void nfsd4_shutdown_callback(struct nfs4_client *); extern void nfsd4_shutdown_copy(struct nfs4_client *clp); void nfsd4_put_client(struct nfs4_client *clp); void nfsd4_async_copy_reaper(struct nfsd_net *nn); +void put_client_no_renew(struct nfs4_client *clp); bool nfsd4_has_active_async_copies(struct nfs4_client *clp); void nfsd_update_cmtime_attr(struct file *f, unsigned int flags); extern struct nfs4_client_reclaim *nfs4_client_to_reclaim(struct xdr_netobj name, -- 2.47.3