Re: [aarch64] refcount_t: use-after-free in NFS with 64k pages

Cristian Marussi
2019-02-05T12:10:37Z

Hi Ben

On 05/02/2019 11:53, Benjamin Coddington wrote:
> Hello Cristian and Punit,
>
> Did you ever get to the bottom of this one? We just saw this on one run
> of our 4.18.0-era ppc64le, and I'm wondering if we ever found the root
> cause.

unfortunately I stopped working actively on finding the root cause, since I've
found a viable workaround that let us unblock our broken LTP runs.

Setting wsize=65536 in NFS bootparams completely solves the issue with 64k pages
(and does NOT break 4k either :D): this confirmed my hyp that there is some sort
of race when accounting refcounts during the lifetime of nfs_page structs which
leads to a misscounted refcount...but as I said I never looked back into that
again (but never say never...)

Hope this helps...

Regards

Cristian

>
> Ben
>