From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qk0-f182.google.com ([209.85.220.182]:33708 "EHLO mail-qk0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934382AbcHJTG1 (ORCPT ); Wed, 10 Aug 2016 15:06:27 -0400 Received: by mail-qk0-f182.google.com with SMTP id t7so53313411qkh.0 for ; Wed, 10 Aug 2016 12:06:26 -0700 (PDT) Message-ID: <1470855983.2694.5.camel@redhat.com> Subject: Re: [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda] From: Jeff Layton To: Josef Bacik , Linus Torvalds Cc: kernel test robot , Al Viro , Chris Mason , David Sterba , "J. Bruce Fields" , LKML , LKP , linux-btrfs , Linux NFS Mailing List Date: Wed, 10 Aug 2016 15:06:23 -0400 In-Reply-To: References: <20160810053947.GG21941@yexl-desktop> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Sender: linux-btrfs-owner@vger.kernel.org List-ID: On Wed, 2016-08-10 at 14:46 -0400, Josef Bacik wrote: > On 08/10/2016 02:25 PM, Linus Torvalds wrote: > > > > > > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik wrote: > > > > > > On 08/10/2016 02:06 PM, Linus Torvalds wrote: > > > > > > > > > > > > More information in the original email on lkml. > > > > > > I'm not subscribed to lkml and for some reason I can't find the original > > > email in any of the lkml/linux-nfs archives.  Could you forward more of the > > > details? > > > > Done. > > > > So my naive fix would be something like this > > > > From: Josef Bacik > Date: Wed, 10 Aug 2016 14:43:08 -0400 > Subject: [PATCH] nfsd: fix dentry refcounting problem > > b44061d0b9 introduced a dentry ref counting bug, previously we were grabbing one > ref to dchild in nfsd_create(), but with the creation of nfsd_create_locked() we > have a ref for dchild from the lookup in nfsd_create(), and then another ref in > nfsd_create_locked().  The ref from the lookup in nfsd_create() is never dropped > and results in dentries still in use at unmount. > > > Signed-off-by: Josef Bacik > --- >   fs/nfsd/vfs.c | 9 ++++++--- >   1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c > index ba944123..ff476e6 100644 > --- a/fs/nfsd/vfs.c > +++ b/fs/nfsd/vfs.c > @@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, > >    if (IS_ERR(dchild)) > >    return nfserrno(host_err); > >    err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); > > - if (err) { > > - dput(dchild); > > + /* > > +  * We unconditionally drop our ref to dchild as fh_compose will have > > +  * already grabbed its own ref for it. > > +  */ > > + dput(dchild); > > + if (err) > >    return err; > > - } > >    return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type, > >    rdev, resfhp); >   } Looks correct to me: Reviewed-by: Jeff Layton From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============1841049480888194945==" MIME-Version: 1.0 From: Jeff Layton To: lkp@lists.01.org Subject: Re: [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} still in use (1) [unmount of btrfs vda] Date: Wed, 10 Aug 2016 15:06:23 -0400 Message-ID: <1470855983.2694.5.camel@redhat.com> In-Reply-To: List-Id: --===============1841049480888194945== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Wed, 2016-08-10 at 14:46 -0400, Josef Bacik wrote: > On 08/10/2016 02:25 PM, Linus Torvalds wrote: > > = > > > > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik wro= te: > > > = > > > On 08/10/2016 02:06 PM, Linus Torvalds wrote: > > > > = > > > > = > > > > More information in the original email on lkml. > > > = > > > I'm not subscribed to lkml and for some reason I can't find the origi= nal > > > email in any of the lkml/linux-nfs archives.=C2=A0=C2=A0Could you for= ward more of the > > > details? > > = > > Done. > > = > = > So my naive fix would be something like this > = > = > > From: Josef Bacik > Date: Wed, 10 Aug 2016 14:43:08 -0400 > Subject: [PATCH] nfsd: fix dentry refcounting problem > = > b44061d0b9 introduced a dentry ref counting bug, previously we were grabb= ing one > ref to dchild in nfsd_create(), but with the creation of nfsd_create_lock= ed() we > have a ref for dchild from the lookup in nfsd_create(), and then another = ref in > nfsd_create_locked().=C2=A0=C2=A0The ref from the lookup in nfsd_create()= is never dropped > and results in dentries still in use at unmount. > = > > Signed-off-by: Josef Bacik > --- > =C2=A0 fs/nfsd/vfs.c | 9 ++++++--- > =C2=A0 1 file changed, 6 insertions(+), 3 deletions(-) > = > diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c > index ba944123..ff476e6 100644 > --- a/fs/nfsd/vfs.c > +++ b/fs/nfsd/vfs.c > @@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh= *fhp, > > =C2=A0=C2=A0 if (IS_ERR(dchild)) > > =C2=A0=C2=A0 return nfserrno(host_err); > > =C2=A0=C2=A0 err =3D fh_compose(resfhp, fhp->fh_export, dchild, fhp); > > - if (err) { > > - dput(dchild); > > + /* > > + =C2=A0* We unconditionally drop our ref to dchild as fh_compose will = have > > + =C2=A0* already grabbed its own ref for it. > > + =C2=A0*/ > > + dput(dchild); > > + if (err) > > =C2=A0=C2=A0 return err; > > - } > > =C2=A0=C2=A0 return nfsd_create_locked(rqstp, fhp, fname, flen, iap, ty= pe, > > =C2=A0=C2=A0 rdev, resfhp); > =C2=A0 } Looks correct to me: Reviewed-by: Jeff Layton --===============1841049480888194945==--