Re: [PATCH] nbd: defer config put in recv_work

[Zheng Qixing <zhengqixing@huawei.com>]

Hi,


在 2025/11/10 8:54, Lizhi Xu 写道:
> On Sat,  8 Nov 2025 15:02:02 +0800, Zheng Qixing wrote:
> > Reported-by: syzbot+56fbf4c7ddf65e95c7cc@syzkaller.appspotmail.com
> > Closes: [🔎] 6907edce.a70a0220.37351b.0014.GAE@google.com/T/">https://lore.kernel.org/all/[🔎] 6907edce.a70a0220.37351b.0014.GAE@google.com/T/
> > Fixes: 87aac3a80af5 ("nbd: make the config put is called before the notifying the waiter")
> > Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
> > Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
> > ---
> >   drivers/block/nbd.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> > index a853c65ac65d..215fc18115b7 100644
> > --- a/drivers/block/nbd.c
> > +++ b/drivers/block/nbd.c
> > @@ -1024,9 +1024,9 @@ static void recv_work(struct work_struct *work)
> >   	nbd_mark_nsock_dead(nbd, nsock, 1);
> >   	mutex_unlock(&nsock->tx_lock);
> >
> > -	nbd_config_put(nbd);
> >   	atomic_dec(&config->recv_threads);
> >   	wake_up(&config->recv_wq);
> > +	nbd_config_put(nbd);
> >   	kfree(args);
> >   }
> This only makes the problem more hidden, and that's far from enough.
> I tested the same patch on syzbot on October 3rd before you did; you
> can check it out here [1].
>
> [1] https://syzkaller.appspot.com/bug?extid=56fbf4c7ddf65e95c7cc


The same patch was triggered by eslam.medhat1993 on Nov 5 via syzbot,

but it didn't produce the same stack trace. Is this stack trace necessarily

related to the UAF issue in nbd? It seems more likely to be a memory

corruption problem, but I'm not certain.


In addition, this issue arises from the mixed use of netlink and ioctl. 
Since

user-space tools generally do not mix these two interfaces, I believe a 
simple

solution along these lines could effectively avoid the UAF problem.


Regards,

Qixing