2017-06-05 08:02:53

by Jia-Ju Bai

Subject: [PATCH] fs: nfs: Fix a sleep-in-atomic bug in nfs_access_add_cache

The driver may sleep under a rcu read lock, and function call path is:
nfs_permission (acquire the lock by rcu_read_lock)
nfs_do_access
nfs_access_add_cache
kmalloc(GFP_KERNEL) --> may sleep

To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".

Signed-off-by: Jia-Ju Bai <[email protected]>
---
fs/nfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32ccd77..7a074db 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2333,7 +2333,7 @@ static void nfs_access_add_rbtree(struct inode *inode, struct nfs_access_entry *

void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *set)
{
- struct nfs_access_entry *cache = kmalloc(sizeof(*cache), GFP_KERNEL);
+ struct nfs_access_entry *cache = kmalloc(sizeof(*cache), GFP_ATOMIC);
if (cache == NULL)
return;
RB_CLEAR_NODE(&cache->rb_node);
--
1.7.9.5

2017-06-05 11:48:46

by Trond Myklebust

Subject: Re: [PATCH] fs: nfs: Fix a sleep-in-atomic bug in nfs_access_add_cache

On Mon, 2017-06-05 at 16:05 +0800, Jia-Ju Bai wrote:
> The driver may sleep under a rcu read lock, and function call path
> is:
> nfs_permission (acquire the lock by rcu_read_lock)
>   nfs_do_access
>     nfs_access_add_cache
>       kmalloc(GFP_KERNEL) --> may sleep
>
> To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
>
> Signed-off-by: Jia-Ju Bai <[email protected]>
> ---
>  fs/nfs/dir.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
> index 32ccd77..7a074db 100644
> --- a/fs/nfs/dir.c
> +++ b/fs/nfs/dir.c
> @@ -2333,7 +2333,7 @@ static void nfs_access_add_rbtree(struct inode
> *inode, struct nfs_access_entry *
>  
>  void nfs_access_add_cache(struct inode *inode, struct
> nfs_access_entry *set)
>  {
> - struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
> GFP_KERNEL);
> + struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
> GFP_ATOMIC);
>   if (cache == NULL)
>   return;
>   RB_CLEAR_NODE(&cache->rb_node);

The RCU locked codepath will not ever hit nfs_access_add_rbtree(). It
returns with an error code of -ECHILD after the test of "may_block".

Cheers
Trond
--
Trond Myklebust
Linux NFS client maintainer, PrimaryData
[email protected]

2017-06-05 12:35:46

by Jia-Ju Bai

Subject: Re: [PATCH] fs: nfs: Fix a sleep-in-atomic bug in nfs_access_add_cache

On 06/05/2017 07:48 PM, Trond Myklebust wrote:
> On Mon, 2017-06-05 at 16:05 +0800, Jia-Ju Bai wrote:
>> The driver may sleep under a rcu read lock, and function call path
>> is:
>> nfs_permission (acquire the lock by rcu_read_lock)
>> nfs_do_access
>> nfs_access_add_cache
>> kmalloc(GFP_KERNEL) --> may sleep
>>
>> To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
>>
>> Signed-off-by: Jia-Ju Bai<[email protected]>
>> ---
>> fs/nfs/dir.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
>> index 32ccd77..7a074db 100644
>> --- a/fs/nfs/dir.c
>> +++ b/fs/nfs/dir.c
>> @@ -2333,7 +2333,7 @@ static void nfs_access_add_rbtree(struct inode
>> *inode, struct nfs_access_entry *
>>
>> void nfs_access_add_cache(struct inode *inode, struct
>> nfs_access_entry *set)
>> {
>> - struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
>> GFP_KERNEL);
>> + struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
>> GFP_ATOMIC);
>> if (cache == NULL)
>> return;
>> RB_CLEAR_NODE(&cache->rb_node);
> The RCU locked codepath will not ever hit nfs_access_add_rbtree(). It
> returns with an error code of -ECHILD after the test of "may_block".
>
> Cheers
> Trond
Yes, I think you are right.

Thanks,
Jia-Ju Bai