Re: [aarch64] refcount_t: use-after-free in NFS with 64k pages

Benjamin Coddington
2019-02-05T12:14:24Z

On 5 Feb 2019, at 7:10, Cristian Marussi wrote:

> Hi Ben
>
> On 05/02/2019 11:53, Benjamin Coddington wrote:
>> Hello Cristian and Punit,
>>
>> Did you ever get to the bottom of this one? We just saw this on one
>> run
>> of our 4.18.0-era ppc64le, and I'm wondering if we ever found the
>> root
>> cause.
>
> unfortunately I stopped working actively on finding the root cause,
> since I've
> found a viable workaround that let us unblock our broken LTP runs.
>
> Setting wsize=65536 in NFS bootparams completely solves the issue with
> 64k pages
> (and does NOT break 4k either :D): this confirmed my hyp that there is
> some sort
> of race when accounting refcounts during the lifetime of nfs_page
> structs which
> leads to a misscounted refcount...but as I said I never looked back
> into that
> again (but never say never...)
>
> Hope this helps...

Hmm, interesting..

Will you share your reproducer with me? That will save me some time.

Ben