Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 27 Nov 2018 20:19:23 -0500
From:   "J. Bruce Fields" <bfields@fieldses.org>
To:     Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Cc:     Jeff Layton <jlayton@kernel.org>, linux-nfs@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: NFSd: NULL-dereference when writing to v4_end_grace when server
 is not yet started
Message-ID: <20181128011923.GB15237@fieldses.org>
References: <CAE5jQCcNCcLX_UvhHFe7BmxE010ULbchd1WN7pDbE2enK-pDZg@mail.gmail.com>
 <20181127205849.GB12810@fieldses.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20181127205849.GB12810@fieldses.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, Nov 27, 2018 at 03:58:49PM -0500, J. Bruce Fields wrote:
> On Sun, Nov 25, 2018 at 09:17:10AM +0300, Anatoly Trosinenko wrote:
> > When manually exploring the kernel NFSd feature, I have stumbled upon
> > a NULL-dereference when writing to v4_end_grace when server is not yet
> > started.
> 
> Thanks for the report!
> 
> I think this is what we want--it's what a lot of the other nfsctl
> methods do.

Hm, no, I'm getting a hang.  It looks like in the nfsd4 state startup we
call a cltrack upcall while holding the nfsd_mutex, then nfsdcltrack
tries to write to end_grace.  That's kind of ugly.

--b.

> commit ad5fdf47b4e3
> Author: J. Bruce Fields <bfields@redhat.com>
> Date:   Tue Nov 27 15:54:17 2018 -0500
> 
>     nfsd4: fix crash on writing v4_end_grace before nfsd startup
>     
>     Anatoly Trosinenko reports that this:
>     
>     1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
>     2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
>     3) From `kvm-xfstests shell`:
>     
>     results in NULL dereference in locks_end_grace.
>     
>     Check that nfsd has been started before trying to end the grace period.
>     
>     Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
>     Signed-off-by: J. Bruce Fields <bfields@redhat.com>
> 
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 6384c9b94898..38b223c1378e 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -1126,7 +1126,13 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
>  		case 'Y':
>  		case 'y':
>  		case '1':
> +			mutex_lock(&nfsd_mutex);
> +			if (nn->nfsd_serv) {
> +				mutex_unlock(&nfsd_mutex);
> +				return -EBUSY;
> +			}
>  			nfsd4_end_grace(nn);
> +			mutex_unlock(&nfsd_mutex);
>  			break;
>  		default:
>  			return -EINVAL;