Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Subject: Re: refcount underflow in nfsd41_destroy_cb
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <6A4BC0CB-9A2F-405B-A7F7-5BFDA4FAD8CB@oracle.com>
Date:   Tue, 31 Mar 2020 13:59:10 -0400
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "Jason A. Donenfeld" <Jason@zx2c4.com>,
        Jan Psota <jasiu@belsznica.pl>
Content-Transfer-Encoding: quoted-printable
Message-Id: <0B4E0C1C-58FF-43EB-BF68-E96BB9DCE664@oracle.com>
References: <CAHmME9ro8BPBTMfu8dEbGmkH7qHLdQ=CXGEOW2C7MR4bmT6T+w@mail.gmail.com>
 <44C9D860-4F51-46B1-88A3-D10DDEF4BD8E@oracle.com>
 <20200322044352.2ff1fbd8.jasiu@belsznica.pl>
 <0C8A86EA-6015-4E9E-9A0E-DAEB4E988269@oracle.com>
 <20200323160919.021e6c8a.jasiu@belsznica.pl>
 <6A4BC0CB-9A2F-405B-A7F7-5BFDA4FAD8CB@oracle.com>
To:     Trond Myklebust <trond.myklebust@hammerspace.com>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

Trond, any thoughts?

> On Mar 24, 2020, at 9:50 AM, Chuck Lever <chuck.lever@oracle.com> =
wrote:
>=20
> Trond,
>=20
>> On Mar 23, 2020, at 11:09 AM, Jan Psota <jasiu@belsznica.pl> wrote:
>>=20
>>> I thought I read in the initial report that you were seeing this
>>> problem only on v5.6-rc6. What is the earliest kernel release
>>> where you saw refcount UaF warnings from nfsd4_destroy_cb?
>>>=20
>> I didn't noticed that earlier too, because until connection breakage =
on
>> WireGuard I did not have any problems related. But when you are =
asking,
>> I found it in my Pentium G2020 system too since 5.5.4 kernel and =
5.4.2
>> looks not affected (I have logs since 01 Jan and fault begin to =
appear
>> on Feb 21, when I switched from 5.4.2 to 5.5.4 kernel a day before)
>>=20
>> $ journalctl | grep nfsd41_destroy_cb
>> lut 21 01:07:58 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> lut 27 01:01:12 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 03 00:59:01 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 03 23:03:02 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 11 11:52:42 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 13 01:12:02 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 14 14:31:39 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 15 20:56:56 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 17 15:58:32 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>> mar 22 15:24:03 mordimer kernel:  nfsd41_destroy_cb+0x2c/0x40 [nfsd]
>>=20
>> I attach NFS part of my .config and a screen dump of menuconfig.
>> <nfs.config><nfs-config.txt>
>=20
> I'm wondering if
>=20
> 2bbfed98a4d8 ("nfsd: Fix races between nfsd4_cb_release() and =
nfsd4_shutdown_callback()")
>=20
> or
>=20
> 12357f1b2c8e ("nfsd: minor 4.1 callback cleanup")
>=20
> might be related to this issue (see down-thread for details and =
backtraces).
>=20
> --
> Chuck Lever

--
Chuck Lever