Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
From:   John Gallagher <john.gallagher@delphix.com>
Date:   Sun, 4 Aug 2019 14:09:33 -0700
Message-ID: <CANHi-RdNP6X1cyqN9z4SfHeC+NmAU+j9a1B03=rASF7_bDDGLQ@mail.gmail.com>
Subject: Clients mounting subdirectories with NFSv3 can prevent unmounts on server
To:     linux-nfs@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

If a client mounts a subdirectory of an export using NFSv3, the server can end
up with invalid (CACHE_VALID bit unset) entries in its export cache. These
entries indirectly have a reference to the struct mount* containing the export,
preventing the filesystem containing the export from being unmounted, even
after the export has been unexported:

    /tmp# mount --bind foo bar
    /tmp# exportfs -o fsid=7 '*:/tmp/bar'
    /tmp# mount -t nfs -o vers=3 localhost:/tmp/bar/a /mnt/a
    /tmp# umount /mnt/a
    /tmp# exportfs -u '*:/tmp/bar'
    /tmp# umount /tmp/bar
    umount: /tmp/bar: target is busy.
    /tmp# cat /proc/net/rpc/nfsd.export/content
    #path domain(flags)
    # /tmp/bar/a    *()

It looks like what's happening is that when rpc.mountd does a downcall to get a
filehandle corresponding to a particular path, exp_parent() traverses the
elements in the given path looking for one which is in the export cache. If
there isn't a valid entry in the cache for the given path, which there won't be
for a subdirectory of an export, then sunrpc_cache_lookup_rcu() inserts an
new, invalid entry.

Are the invalid entries inserted while executing exp_parent() useful? Could we
prevent them from being added?

Thanks,
John