Return-Path: Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:9507 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753724AbcHJSsc (ORCPT ); Wed, 10 Aug 2016 14:48:32 -0400 Subject: Re: [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda] To: Linus Torvalds References: <20160810053947.GG21941@yexl-desktop> CC: kernel test robot , Al Viro , Chris Mason , David Sterba , "J. Bruce Fields" , LKML , LKP , linux-btrfs , Linux NFS Mailing List From: Josef Bacik Message-ID: Date: Wed, 10 Aug 2016 14:46:27 -0400 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Sender: linux-nfs-owner@vger.kernel.org List-ID: On 08/10/2016 02:25 PM, Linus Torvalds wrote: > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik wrote: >> On 08/10/2016 02:06 PM, Linus Torvalds wrote: >>> >>> More information in the original email on lkml. >> >> I'm not subscribed to lkml and for some reason I can't find the original >> email in any of the lkml/linux-nfs archives. Could you forward more of the >> details? > > Done. > So my naive fix would be something like this From: Josef Bacik Date: Wed, 10 Aug 2016 14:43:08 -0400 Subject: [PATCH] nfsd: fix dentry refcounting problem b44061d0b9 introduced a dentry ref counting bug, previously we were grabbing one ref to dchild in nfsd_create(), but with the creation of nfsd_create_locked() we have a ref for dchild from the lookup in nfsd_create(), and then another ref in nfsd_create_locked(). The ref from the lookup in nfsd_create() is never dropped and results in dentries still in use at unmount. Signed-off-by: Josef Bacik --- fs/nfsd/vfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index ba944123..ff476e6 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (IS_ERR(dchild)) return nfserrno(host_err); err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); - if (err) { - dput(dchild); + /* + * We unconditionally drop our ref to dchild as fh_compose will have + * already grabbed its own ref for it. + */ + dput(dchild); + if (err) return err; - } return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type, rdev, resfhp); } -- 2.5.5