Re: nfsd use after free in 4.0-rc

[Jeff Layton <jeff.layton@primarydata.com>]

[-- Attachment #1: Type: text/plain, Size: 1634 bytes --]

On Mon, 16 Mar 2015 11:28:10 -0700
Christoph Hellwig <hch@infradead.org> wrote:

> On Mon, Mar 16, 2015 at 11:58:45AM -0400, J. Bruce Fields wrote:
> > > 3240		list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
> > > 3241		spin_lock(&fp->fi_lock);
> > > 3242		list_add(&stp->st_perfile, &fp->fi_stateids);
> > 
> > I assume you're testing only NFS v4.1?
> 
> Exactly. I'm testing with a version of this patch applied to force 4.1:
> 
> http://git.infradead.org/users/hch/pnfs.git/commitdiff/72ef9b95aaed593ac061bb380bc27ced4fd67b4b

I've been using 4.2, fwiw...

So far, this bug has turned out to be pretty elusive, I've looked all
over the so_count handling and I don't see anywhere that we've got a
refcount imbalance. I must be missing something, but it all looks right
AFAICT.

I've also instrumented the code to look for 0->1 transitions on the
so_count, and that hasn't fired. I also looked to see whether Bruce's
hunch about the nfsd4_find_existing_open thing might be a problem with
the sc_count going 0->1 since we're taking a reference there w/o
holding the cl_lock. I haven't seen that happen either.

Mostly when I see this bug without memory poisoning enabled, it
manifests itself as list corruption in one of the stateowner lists
during nfsd4_close. Curiously, the attached patch seems to make that
problem go away, but the generic/011 test seems to fail most of the
time with this in the log:

    Cannot chdir out of pid directory: Stale file handle

...but if I turn up poisoning of the nfsd4_openowners slab then I get
an oops similar to what HCH is seeing.

-- 
Jeff Layton <jeff.layton@primarydata.com>

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-nfsd-poison-so_owner.data-before-freeing-it.patch --]
[-- Type: text/x-patch, Size: 0 bytes --]