CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Check svc pool percpu counter allocation

svccreate() initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit() fails when allocpercpugfp() cannot satisfy the allocation, leaving the failed counter with fbc->counters == NULL and its embedded rawspinlockt, listhead, and count never initialized. svccreate() returns the half-constructed svcserv to nfsd, lockd, or the NFS callback service anyway.

Once that service is live, the hot-path increments in svcxprtenqueue(), svchandlexprt(), and svcpoolwakeidlethread() reach a counter whose backing pointer is NULL. The pointer is a per-cpu offset, so the access does not fault: it resolves to offset zero of the current CPU's per-cpu area and silently corrupts whatever variable lives there. A /proc/fs/nfsd/poolstats read walks the same NULL per-cpu storage and returns garbage, and on CONFIGDEBUGSPINLOCK or lockdep it splats on the never-initialized lock.

Creating the broken service requires a percpu allocation failure during RPC server startup, so it is reachable only by a local administrator under memory pressure or fault injection; a remote peer cannot induce the bad state on its own.

Check each percpucounterinit() return value in svccreate() and fail when an allocation fails, unwinding the counters already set up in the current pool and in every pool initialized before it. A discrete percpucounterdestroy() per counter at teardown frees each per-cpu allocation exactly once.