Re: [PATCH][RFC] use after free in NLM subsystem -- how best to fix it?

["J. Bruce Fields" <bfields@fieldses.org>]

On Thu, Sep 27, 2007 at 01:59:38PM -0400, Jeff Layton wrote:
> Now that I've started really digging into this, I'm thinking that I may
> be wrong about the race that exists in current mainline. There was a
> change done ~June 2007:
> 
> commit 34f52e3591f241b825353ba27def956d8487c400
> Author: Trond Myklebust <Trond.Myklebust@netapp.com>
> Date:   Thu Jun 14 16:40:31 2007 -0400
> 
>     SUNRPC: Convert rpc_clnt->cl_users to a kref
>     
>     Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
> 
> ...this changed nlm_destroy_host from just setting cl_dead to instead
> use rpc_shutdown_client. So this code now actually kills active RPC
> tasks for the RPC client and waits for them to come down instead of
> just marking the client dead. This should mitigate the race that
> definitely exists in earlier kernels.

Is there still a window where lockd could be killed just as someone is
starting a new rpc (but the task isn't yet visible to
rpc_shutdown_client)?

--b.

> I have seen a crash on recent kernels that looks very similar to the
> problem that I originally described. Somehow a nlmsvc_grant_callback
> outlived its lockd. I've only seen it once though, so I think I have to
> conclude that the race there is something different and much more
> subtle.
> 
> Adding reference counting might still be the way to go, but it's
> not clear to me that basing it on adding and removing from the
> nlm_blocked list will eliminate whatever this race is.
> 
> -- 
> Jeff Layton <jlayton@redhat.com>
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> NFS maillist  -  NFS@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs