CVE-2024-53216: In the Linux kernel, the following vulnerability has been resolved:  nfsd: release svc_expkey/svc_export with rcu_work  The last reference for `cache_head` can be reduced to zero in `c_show` and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently, `svc_export_put` and `expkey_put` will be invoked, leading to two issues:  1. The `svc_export_put` will directly free ex_uuid. However,    `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can    trigger a use-after-free issue, shown below.     ==================================================================    BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]    Read of size 1 at addr ff11000010fdc120 by task cat/870     CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS    1.16.1-2.fc37 04/01/2014    Call Trace:     <TASK>     dump_stack_lvl+0x53/0x70     print_address_description.constprop.0+0x2c/0x3a0     print_report+0xb9/0x280     kasan_report+0xae/0xe0     svc_export_show+0x362/0x430 [nfsd]     c_show+0x161/0x390 [sunrpc]     seq_read_iter+0x589/0x770     seq_read+0x1e5/0x270     proc_reg_read+0xe1/0x140     vfs_read+0x125/0x530     ksys_read+0xc1/0x160     do_syscall_64+0x5f/0x170     entry_SYSCALL_64_after_hwframe+0x76/0x7e     Allocated by task 830:     kasan_save_stack+0x20/0x40     kasan_save_track+0x14/0x30     __kasan_kmalloc+0x8f/0xa0     __kmalloc_node_track_caller_noprof+0x1bc/0x400     kmemdup_noprof+0x22/0x50     svc_export_parse+0x8a9/0xb80 [nfsd]     cache_do_downcall+0x71/0xa0 [sunrpc]     cache_write_procfs+0x8e/0xd0 [sunrpc]     proc_reg_write+0xe1/0x140     vfs_write+0x1a5/0x6d0     ksys_write+0xc1/0x160     do_syscall_64+0x5f/0x170     entry_SYSCALL_64_after_hwframe+0x76/0x7e     Freed by task 868:     kasan_save_stack+0x20/0x40     kasan_save_track+0x14/0x30     kasan_save_free_info+0x3b/0x60     __kasan_slab_free+0x37/0x50     kfree+0xf3/0x3e0     svc_export_put+0x87/0xb0 [nfsd]     cache_purge+0x17f/0x1f0 [sunrpc]     nfsd_destroy_serv+0x226/0x2d0 [nfsd]     nfsd_svc+0x125/0x1e0 [nfsd]     write_threads+0x16a/0x2a0 [nfsd]     nfsctl_transaction_write+0x74/0xa0 [nfsd]     vfs_write+0x1a5/0x6d0     ksys_write+0xc1/0x160     do_syscall_64+0x5f/0x170     entry_SYSCALL_64_after_hwframe+0x76/0x7e  2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.    However, `svc_export_put`/`expkey_put` will call path_put, which    subsequently triggers a sleeping operation due to the following    `dput`.     =============================    WARNING: suspicious RCU usage    5.10.0-dirty #141 Not tainted    -----------------------------    ...    Call Trace:    dump_stack+0x9a/0xd0    ___might_sleep+0x231/0x240    dput+0x39/0x600    path_put+0x1b/0x30    svc_export_put+0x17/0x80    e_show+0x1c9/0x200    seq_read_iter+0x63f/0x7c0    seq_read+0x226/0x2d0    vfs_read+0x113/0x2c0    ksys_read+0xc9/0x170    do_syscall_64+0x33/0x40    entry_SYSCALL_64_after_hwframe+0x67/0xd1  Fix these issues by using `rcu_work` to help release `svc_expkey`/`svc_export`. This approach allows for an asynchronous context to invoke `path_put` and also facilitates the freeing of `uuid/exp/key` after an RCU grace period.