nfsd CopyNotify UAF

Vulnerability analysis

The NFS server's server-to-server copy offload feature lets an authenticated NFSv4.2 client cancel a copy-notify stateid via the OFFLOAD_CANCEL operation, but the cancellation path did not verify that the requesting client actually owns the target stateid. The lookup key is cyclically allocated and guessable, and the embedded client identifier is a fixed per-network value, so any authenticated client could cancel and free another client's stateid. Freeing a stateid still in use by its legitimate owner creates a use-after-free condition that can corrupt kernel heap memory. The fix adds an ownership check comparing the creating client's identifier against the requesting client's identifier, returning an error on mismatch instead of freeing the entry. The vulnerable path is reachable from any authenticated NFSv4.2 client over the network when the inter-server copy offload feature is enabled.