From: Chuck Lever <chuck.lever@oracle.com>

Each per-net sunrpc cache exposes three files under
/proc/net/rpc/<cachename>/: content, channel, and flush.
Their open helpers (content_open, cache_open, open_flush) take a
reference on cd->owner via try_module_get() but no reference on
cd->net. When the network namespace exits, cache_unregister_net()
followed by cache_destroy_net() free cd->hash_table and cd
synchronously without RCU deferral. Any subsequent operation on
the still-open file dereferences the freed cache_detail.

The fault produced by sosreport on aarch64 and ppc64le shows the
typical signature: cache_check_rcu() faults reading h->flags off
a garbage cache_head pointer that came from __cache_seq_start()
walking a freed cd->hash_table. Commit e7fcf179b82d ("NFSD: Hold
net reference for the lifetime of /proc/fs/nfs/exports fd") closed
this hole only for the /proc/fs/nfs/exports file, which has its own
open path; the sunrpc cache files were left exposed.

Take a get_net(cd->net) in content_open(), cache_open(), and
open_flush() once the open has otherwise succeeded, and a matching
put_net() at the tail of each release helper. Holding the net
reference for the open file lifetime prevents the namespace from
exiting while a cache fd is open, which in turn prevents
cache_destroy_net() from running and freeing cd from under the
reader.

put_net() can drop the last namespace reference, in which case
__put_net() queues net_cleanup_work on netns_wq. That work runs
ops_undo_list() on another CPU, which invokes sunrpc_exit_net()
and frees cd via cache_destroy_net(). The release helper must
not dereference cd after put_net(): cache_release(),
content_release(), and release_flush() therefore capture
cd->owner and cd->net into local variables before calling
put_net(net) and module_put(owner).

Reported-by: Misbah Anjum N <redacted>
Closes: https://lore.kernel.org/linux-nfs/8cf80f450085ac17164e8fa1391e9635@linux.ibm.com/ (local)
Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu")
Assisted-by: Claude:claude-opus-4-7[1m]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/cache.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 733bcd3daa46..be7a0c8c416e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c

@@ -1037,6 +1037,7 @@ static int cache_open(struct inode *inode, struct file *filp,
 	if (filp->f_mode & FMODE_WRITE)
 		atomic_inc(&cd->writers);
 	filp->private_data = rp;
+	get_net(cd->net);
 	return 0;
 }
 

@@ -1044,6 +1045,8 @@ static int cache_release(struct inode *inode, struct file *filp,
 			 struct cache_detail *cd)
 {
 	struct cache_reader *rp = filp->private_data;
+	struct module *owner;
+	struct net *net;
 
 	if (rp) {
 		struct cache_request *rq = NULL;

@@ -1080,7 +1083,10 @@ static int cache_release(struct inode *inode, struct file *filp,
 		atomic_dec(&cd->writers);
 		cd->last_close = seconds_since_boot();
 	}
-	module_put(cd->owner);
+	owner = cd->owner;
+	net = cd->net;
+	put_net(net);
+	module_put(owner);
 	return 0;
 }
 

@@ -1466,14 +1472,19 @@ static int content_open(struct inode *inode, struct file *file,
 
 	seq = file->private_data;
 	seq->private = cd;
+	get_net(cd->net);
 	return 0;
 }
 
 static int content_release(struct inode *inode, struct file *file,
 		struct cache_detail *cd)
 {
+	struct module *owner = cd->owner;
+	struct net *net = cd->net;
 	int ret = seq_release(inode, file);
-	module_put(cd->owner);
+
+	put_net(net);
+	module_put(owner);
 	return ret;
 }
 

@@ -1482,13 +1493,18 @@ static int open_flush(struct inode *inode, struct file *file,
 {
 	if (!cd || !try_module_get(cd->owner))
 		return -EACCES;
+	get_net(cd->net);
 	return nonseekable_open(inode, file);
 }
 
 static int release_flush(struct inode *inode, struct file *file,
 			struct cache_detail *cd)
 {
-	module_put(cd->owner);
+	struct module *owner = cd->owner;
+	struct net *net = cd->net;
+
+	put_net(net);
+	module_put(owner);
 	return 0;
 }
 

-- 
2.53.0