[BUG] After unloading the nfsd module, a use-after-free occurred due to Objects remaining on __kmem_cache_shutdown().

[김강민]

Dear Linux kernel developers and maintainers,

Hello,
This bug was discovered through syzkaller.

Kernel driver involved: nfsd

Version detected by syzkaller:
- Commit version: cd5a0afbdf8033dc83786315d63f8b325bdba2fd

Details
If the test driver is forcibly unloaded, objects remain in memory,
which can later lead to issues such as use-after-free.
Additionally, This issue can be easily reproduced with the following command.
$ sudo rmmod -f nfsd
Note: Since the nfsd service is running internally with open ports and
mounted shares, it may affect this issue. Therefore, the boot log is
attached as a file.

Please let me know if any further information is required.

Best Regards,
GangMin Kim.

[Chuck Lever]

On 10/11/25 4:19 PM, 김강민 wrote:
> Dear Linux kernel developers and maintainers,
>
> Hello,
> This bug was discovered through syzkaller.
>
> Kernel driver involved: nfsd
>
> Version detected by syzkaller:
> - Commit version: cd5a0afbdf8033dc83786315d63f8b325bdba2fd

In my Linux kernel repo, commit cd5a0a is not related to NFSD:

cel@oracle-102:~/src/linux/for-korg$ git show
cd5a0afbdf8033dc83786315d63f8b325bdba2fd
commit cd5a0afbdf8033dc83786315d63f8b325bdba2fd
Merge: ed4d6e92463e 3f39f5652037
Author: Linus Torvalds <torv...@linux-foundation.org>
AuthorDate: Wed Oct 8 11:44:21 2025 -0700
Commit: Linus Torvalds <torv...@linux-foundation.org>
CommitDate: Wed Oct 8 11:44:21 2025 -0700

Merge tag 'mailbox-v6.18' of
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox

Pull mailbox updates from Jassi Brar:


Would it be possible for you to bisect the failure?

> Details
> If the test driver is forcibly unloaded, objects remain in memory,
> which can later lead to issues such as use-after-free.
> Additionally, This issue can be easily reproduced with the following command.
> $ sudo rmmod -f nfsd
> Note: Since the nfsd service is running internally with open ports and
> mounted shares, it may affect this issue. Therefore, the boot log is
> attached as a file.
>
> Please let me know if any further information is required.
>
> Best Regards,
> GangMin Kim.

--
Chuck Lever

[NeilBrown]

On Sun, 12 Oct 2025, 김강민 wrote:
> Dear Linux kernel developers and maintainers,
>
> Hello,
> This bug was discovered through syzkaller.

I don't think this is a bug.
Passing O_TRUNC to delete_module(), or passing -f to rmmod is documented
a "dangerous" and "extremely dangerous" respectively.

If you do something that is dangerous, you should expect bad things to
happen.

Presumably the nfsd exit_module function is failing because something is
still in use - as it is allowed to do - and the module is being removed
anyway.

i.e. the "bug" report is invalid.

NeilBrown