From:   Trond Myklebust <trondmy@hammerspace.com>
To:     "anna.schumaker@netapp.com" <anna.schumaker@netapp.com>,
        "neilb@suse.com" <neilb@suse.com>
CC:     "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>,
        "chuck.lever@oracle.com" <chuck.lever@oracle.com>
Subject: Re: [PATCH] NFS: fix mount/umount race in nlmclnt.
Thread-Topic: [PATCH] NFS: fix mount/umount race in nlmclnt.
Thread-Index: AQHU3etj5JNP1oJmLUSrOoBVDjduUaYSPlYA
Date:   Tue, 19 Mar 2019 02:40:27 +0000
Message-ID: <4aaf0c67c164bc4bf5d13857774317e77a393e0f.camel@hammerspace.com>
References: <877ecv8zzf.fsf@notabene.neil.brown.name>
In-Reply-To: <877ecv8zzf.fsf@notabene.neil.brown.name>
Accept-Language: en-US, en-GB
Content-Language: en-US
received-spf: None (protection.outlook.com: hammerspace.com does not designate
 permitted sender hosts)
Content-Type: multipart/signed; micalg="pgp-sha256";
        protocol="application/pgp-signature"; boundary="=-7BD6GcfyGoZhUBPWjsHX"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 6bcd0f85-c500-4849-a424-08d6ac143ee7
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Mar 2019 02:40:27.2364
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0d4fed5c-3a70-46fe-9430-ece41741f59e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR13MB2575
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

--=-7BD6GcfyGoZhUBPWjsHX
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, 2019-03-19 at 11:33 +1100, NeilBrown wrote:
> If the last NFSv3 unmount from a given host races with a mount from
> the
> same host, we can destroy an nlm_host that is still in use.
>=20
> Specifically nlmclnt_lookup_host() can increment h_count on
> an nlm_host that nlmclnt_release_host() has just successfully called
> refcount_dec_and_test() on.
> Once nlmclnt_lookup_host() drops the mutex, nlm_destroy_host_lock()
> will be called to destroy the nlmclnt which is now in use again.
>=20
> The cause of the problem is that the dec_and_test happens outside the
> locked region.  This is easily fixed by using
> refcount_dec_and_mutex_lock().
>=20
> Fixes: 8ea6ecc8b075 ("lockd: Create client-side nlm_host cache")
> Cc: stable@vger.kernel.org (v2.6.38+)
> Signed-off-by: NeilBrown <neilb@suse.com>
> ---
>  fs/lockd/host.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>=20
> diff --git a/fs/lockd/host.c b/fs/lockd/host.c
> index 93fb7cf0b92b..f0b5c987d6ae 100644
> --- a/fs/lockd/host.c
> +++ b/fs/lockd/host.c
> @@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host
> *host)
> =20
>  	WARN_ON_ONCE(host->h_server);
> =20
> -	if (refcount_dec_and_test(&host->h_count)) {
> +	if (refcount_dec_and_mutex_lock(&host->h_count,
> &nlm_host_mutex)) {
>  		WARN_ON_ONCE(!list_empty(&host->h_lockowners));
>  		WARN_ON_ONCE(!list_empty(&host->h_granted));
>  		WARN_ON_ONCE(!list_empty(&host->h_reclaim));
> =20
> -		mutex_lock(&nlm_host_mutex);
>  		nlm_destroy_host_locked(host);
>  		mutex_unlock(&nlm_host_mutex);
>  	}

Thanks Neil! Applying to linux-next.

--=20
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trond.myklebust@hammerspace.com


--=-7BD6GcfyGoZhUBPWjsHX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEESQctxSBg8JpV8KqEZwvnipYKAPIFAlyQVpIACgkQZwvnipYK
APKLoBAAugy0YWVE5uNO+3JPypn/9x5D/c0XTusCf9wVIouqTZSI8/NtmxX2Bs7F
uOztFXBvgfBtaGcvyr3AM2M2dqMiJSiP4eZ4papRYLu01idIkb1FaePJOO8P5j8o
rAzbT5xcmceLW8mktICQnzfZUGKHZN4YGuPYX6D9gXdsgM196ih3zx3USTwj/tCW
b3cF0ufZ/0JN2tSTwsw1kcC26VFW2vEz+UbO82/WsfJ/075CJKX3p1Kw0wh+99LE
7f1Y6dQcdDQl503jlUg1jsgax2zRDTnk6ZHVNdCiN7pyNyPaDiEFRRi5XrGebCTQ
oXtCaMyydG7bmcjRMithKNATw062qrriE4/4/D8upoVj3Qex/UydNSVALjFgnCVq
Y2yJ3iJda96ehI66wCAZ4/igbPoFTVNKIdFsyiai2esMN8jGAFiiDF0VHVk4uM2R
CHSwGyu3tRn6gpuSfJNARjQqcCBf5dCa8Jkz75mu3V7T+zm5+a12wqJ1mLrROTZd
/zP6EnMA/aLkYfCNFJyFZwnT+iM34AAfYMjELttSrgWmQEI6nHJFxTww0ucP+goK
okaat/id1lyycSoZv+HMc2R7tGH2uvgktNEBmBK2KctYEfc6IM2GQX54qQ8Hqbz9
8zt/aaVsfTQqmQztfoDeY0BZVc+QiUj2P1sAPab0/aX4VFiNnPk=
=9Zr7
-----END PGP SIGNATURE-----

--=-7BD6GcfyGoZhUBPWjsHX--