Return-Path: linux-nfs-owner@vger.kernel.org Received: from icebox.esperi.org.uk ([81.187.191.129]:54802 "EHLO mail.esperi.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756056Ab2JWRGX (ORCPT ); Tue, 23 Oct 2012 13:06:23 -0400 From: Nix To: "Myklebust\, Trond" Cc: "J. Bruce Fields" , "Ted Ts'o" , "linux-kernel\@vger.kernel.org" , "Schumaker\, Bryan" , Peng Tao , "gregkh\@linuxfoundation.org" , "linux-nfs\@vger.kernel.org" , Stanislav Kinsbursky Subject: Re: Heads-up: 3.6.2 / 3.6.3 NFS server oops: 3.6.2+ regression? (also an unrelated ext4 data loss bug) References: <87objupjlr.fsf@spindle.srvr.nix> <20121023013343.GB6370@fieldses.org> <87mwzdnuww.fsf@spindle.srvr.nix> <20121023143019.GA3040@fieldses.org> <874nllxi7e.fsf_-_@spindle.srvr.nix> <20121023164621.GC3040@fieldses.org> <4FA345DA4F4AE44899BD2B03EEEC2FA90928CA6F@SACEXCMBX04-PRD.hq.netapp.com> Date: Tue, 23 Oct 2012 18:05:18 +0100 In-Reply-To: <4FA345DA4F4AE44899BD2B03EEEC2FA90928CA6F@SACEXCMBX04-PRD.hq.netapp.com> (Trond Myklebust's message of "Tue, 23 Oct 2012 16:56:00 +0000") Message-ID: <87vce1w241.fsf@spindle.srvr.nix> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-nfs-owner@vger.kernel.org List-ID: On 23 Oct 2012, Trond Myklebust spake thusly: > On Tue, 2012-10-23 at 12:46 -0400, J. Bruce Fields wrote: >> Looks like there's some confusion about whether nsm_client_get() returns >> NULL or an error? > > nsm_client_get() looks extremely racy in the case where ln->nsm_users == > 0. Since we never recheck the value of ln->nsm_users after taking > nsm_create_mutex, what is stopping 2 different threads from both setting > ln->nsm_clnt and re-initialising ln->nsm_users? Yep. At the worst possible time: spin_lock(&ln->nsm_clnt_lock); if (ln->nsm_users) { if (--ln->nsm_users) ln->nsm_clnt = NULL; (1) shutdown = !ln->nsm_users; } spin_unlock(&ln->nsm_clnt_lock); If a thread reinitializes nsm_users at point (1), after the assignment, we could well end up with ln->nsm_clnt NULL and shutdown false. A bit later, nsm_mon_unmon gets called with a NULL clnt, and boom. This seems particularly likely if there is only one nsm_user (which is true in my case, since I have only one active network namespace). -- NULL && (void)