Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: [PATCH v2] Re: Strange segmentation violations of rpc.gssd in Debian
 Buster
To:     "J. Bruce Fields" <bfields@fieldses.org>
Cc:     "Kraus, Sebastian" <sebastian.kraus@tu-berlin.de>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>,
        Steve Dickson <steved@redhat.com>,
        Olga Kornievskaia <aglo@umich.edu>
References: <28a44712b25c4420909360bd813f8bfd@tu-berlin.de>
 <20200620170316.GH1514@fieldses.org>
 <5c45562c90404838944ee71a1d926c74@tu-berlin.de>
 <20200622223628.GC11051@fieldses.org>
 <406fe972135846dc8a23b60be59b0590@tu-berlin.de>
 <1527b158-3404-168c-8908-de4b8a709ccd@nazar.ca>
 <e9de5046e7734e728e64b386314a5d2e@tu-berlin.de>
 <c1c314fd-1855-cf04-3ec5-5f6eb35719a5@nazar.ca>
 <20200626194622.GB11850@fieldses.org>
 <3eb80b1f-e4d3-e87c-aacd-34dc28637948@nazar.ca>
 <20200626210243.GD11850@fieldses.org>
From:   Doug Nazar <nazard@nazar.ca>
Message-ID: <bebca60d-09e4-f118-c195-c6245e6496fb@nazar.ca>
Date:   Fri, 26 Jun 2020 17:30:15 -0400
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:78.0) Gecko/20100101
 Firefox/78.0 Thunderbird/78.0
MIME-Version: 1.0
In-Reply-To: <20200626210243.GD11850@fieldses.org>
Content-Type: multipart/mixed;
 boundary="------------C76790290F3F872CF2D00FA5"
Content-Language: en-US
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

This is a multi-part message in MIME format.
--------------C76790290F3F872CF2D00FA5
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 2020-06-26 17:02, J. Bruce Fields wrote:
> Unless I'm missing something--an upcall thread could still be using this
> file descriptor.
>
> If we're particularly unlucky, we could do a new open in a moment and
> reuse this file descriptor number, and then then writes in do_downcall()
> could end up going to some other random file.
>
> I think we want these closes done by gssd_free_client() in the !refcnt
> case?

Makes sense. I was thinking more that it was an abort situation and we 
shouldn't be sending any data to the kernel but re-use is definitely a 
concern.

I've split it so that we are removed from the event loop in destroy() 
but the close happens in free().

Doug


--------------C76790290F3F872CF2D00FA5
Content-Type: text/plain; charset=UTF-8;
 name="0001-gssd-Refcount-struct-clnt_info-to-protect-multithrea.patch"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename*0="0001-gssd-Refcount-struct-clnt_info-to-protect-multithrea.pa";
 filename*1="tch"

RnJvbSA4ZWY0OTA4MWU4YTQyYmZhMDViYjYzMjY1Y2Q0Zjk1MWUyYjIzNDEzIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBEb3VnIE5hemFyIDxuYXphcmRAbmF6YXIuY2E+CkRh
dGU6IEZyaSwgMjYgSnVuIDIwMjAgMTY6MDI6MDQgLTA0MDAKU3ViamVjdDogW1BBVENIXSBn
c3NkOiBSZWZjb3VudCBzdHJ1Y3QgY2xudF9pbmZvIHRvIHByb3RlY3QgbXVsdGl0aHJlYWQg
dXNhZ2UKClN0cnVjdCBjbG50X2luZm8gaXMgc2hhcmVkIHdpdGggdGhlIHZhcmlvdXMgdXBj
YWxsIHRocmVhZHMgc28Kd2UgbmVlZCB0byBlbnN1cmUgdGhhdCBpdCBzdGF5cyBhcm91bmQg
ZXZlbiBpZiB0aGUgY2xpZW50IGRpcgpnZXRzIHJlbW92ZWQuCgpSZXBvcnRlZC1ieTogU2Vi
YXN0aWFuIEtyYXVzIDxzZWJhc3RpYW4ua3JhdXNAdHUtYmVybGluLmRlPgpTaWduZWQtb2Zm
LWJ5OiBEb3VnIE5hemFyIDxuYXphcmRAbmF6YXIuY2E+Ci0tLQogdXRpbHMvZ3NzZC9nc3Nk
LmMgICAgICB8IDY3ICsrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0t
LQogdXRpbHMvZ3NzZC9nc3NkLmggICAgICB8ICA1ICsrLS0KIHV0aWxzL2dzc2QvZ3NzZF9w
cm9jLmMgfCAgNCArLS0KIDMgZmlsZXMgY2hhbmdlZCwgNTUgaW5zZXJ0aW9ucygrKSwgMjEg
ZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvdXRpbHMvZ3NzZC9nc3NkLmMgYi91dGlscy9n
c3NkL2dzc2QuYwppbmRleCA1ODhkYTBmYi4uYjQwYzMyMjAgMTAwNjQ0Ci0tLSBhL3V0aWxz
L2dzc2QvZ3NzZC5jCisrKyBiL3V0aWxzL2dzc2QvZ3NzZC5jCkBAIC05MCw5ICs5MCw3IEBA
IGNoYXIgKmNjYWNoZWRpciA9IE5VTEw7CiAvKiBBdm9pZCBETlMgcmV2ZXJzZSBsb29rdXBz
IG9uIHNlcnZlciBuYW1lcyAqLwogc3RhdGljIGJvb2wgYXZvaWRfZG5zID0gdHJ1ZTsKIHN0
YXRpYyBib29sIHVzZV9nc3Nwcm94eSA9IGZhbHNlOwotaW50IHRocmVhZF9zdGFydGVkID0g
ZmFsc2U7Ci1wdGhyZWFkX211dGV4X3QgcG11dGV4ID0gUFRIUkVBRF9NVVRFWF9JTklUSUFM
SVpFUjsKLXB0aHJlYWRfY29uZF90IHBjb25kID0gUFRIUkVBRF9DT05EX0lOSVRJQUxJWkVS
OworcHRocmVhZF9tdXRleF90IGNscF9sb2NrID0gUFRIUkVBRF9NVVRFWF9JTklUSUFMSVpF
UjsKIAogVEFJTFFfSEVBRCh0b3BkaXJfbGlzdF9oZWFkLCB0b3BkaXIpIHRvcGRpcl9saXN0
OwogCkBAIC0zNTksMjAgKzM1NywyOCBAQCBvdXQ6CiAJZnJlZShwb3J0KTsKIH0KIAorLyog
QWN0dWFsbHkgZnJlZXMgY2xwIGFuZCBmaWVsZHMgdGhhdCBtaWdodCBiZSB1c2VkIGZyb20g
b3RoZXIKKyAqIHRocmVhZHMgaWYgd2FzIGxhc3QgcmVmZXJlbmNlLgorICovCiBzdGF0aWMg
dm9pZAotZ3NzZF9kZXN0cm95X2NsaWVudChzdHJ1Y3QgY2xudF9pbmZvICpjbHApCitnc3Nk
X2ZyZWVfY2xpZW50KHN0cnVjdCBjbG50X2luZm8gKmNscCkKIHsKLQlpZiAoY2xwLT5rcmI1
X2ZkID49IDApIHsKKwlpbnQgcmVmY250OworCisJcHRocmVhZF9tdXRleF9sb2NrKCZjbHBf
bG9jayk7CisJcmVmY250ID0gLS1jbHAtPnJlZmNvdW50OworCXB0aHJlYWRfbXV0ZXhfdW5s
b2NrKCZjbHBfbG9jayk7CisJaWYgKHJlZmNudCA+IDApCisJCXJldHVybjsKKworCXByaW50
ZXJyKDMsICJmcmVlaW5nIGNsaWVudCAlc1xuIiwgY2xwLT5yZWxwYXRoKTsKKworCWlmIChj
bHAtPmtyYjVfZmQgPj0gMCkKIAkJY2xvc2UoY2xwLT5rcmI1X2ZkKTsKLQkJZXZlbnRfZGVs
KCZjbHAtPmtyYjVfZXYpOwotCX0KIAotCWlmIChjbHAtPmdzc2RfZmQgPj0gMCkgeworCWlm
IChjbHAtPmdzc2RfZmQgPj0gMCkKIAkJY2xvc2UoY2xwLT5nc3NkX2ZkKTsKLQkJZXZlbnRf
ZGVsKCZjbHAtPmdzc2RfZXYpOwotCX0KIAotCWlub3RpZnlfcm1fd2F0Y2goaW5vdGlmeV9m
ZCwgY2xwLT53ZCk7CiAJZnJlZShjbHAtPnJlbHBhdGgpOwogCWZyZWUoY2xwLT5zZXJ2aWNl
bmFtZSk7CiAJZnJlZShjbHAtPnNlcnZlcm5hbWUpOwpAQCAtMzgwLDYgKzM4NiwyNCBAQCBn
c3NkX2Rlc3Ryb3lfY2xpZW50KHN0cnVjdCBjbG50X2luZm8gKmNscCkKIAlmcmVlKGNscCk7
CiB9CiAKKy8qIENhbGxlZCB3aGVuIHJlbW92aW5nIGZyb20gY2xudF9saXN0IHRvIHRlYXIg
ZG93biBldmVudCBoYW5kbGluZy4KKyAqIFdpbGwgdGhlbiBmcmVlIGNscCBpZiB3YXMgbGFz
dCByZWZlcmVuY2UuCisgKi8KK3N0YXRpYyB2b2lkCitnc3NkX2Rlc3Ryb3lfY2xpZW50KHN0
cnVjdCBjbG50X2luZm8gKmNscCkKK3sKKwlwcmludGVycigzLCAiZGVzdHJveWluZyBjbGll
bnQgJXNcbiIsIGNscC0+cmVscGF0aCk7CisKKwlpZiAoY2xwLT5rcmI1X2ZkID49IDApCisJ
CWV2ZW50X2RlbCgmY2xwLT5rcmI1X2V2KTsKKworCWlmIChjbHAtPmdzc2RfZmQgPj0gMCkK
KwkJZXZlbnRfZGVsKCZjbHAtPmdzc2RfZXYpOworCisJaW5vdGlmeV9ybV93YXRjaChpbm90
aWZ5X2ZkLCBjbHAtPndkKTsKKwlnc3NkX2ZyZWVfY2xpZW50KGNscCk7Cit9CisKIHN0YXRp
YyB2b2lkIGdzc2Rfc2Nhbih2b2lkKTsKIAogc3RhdGljIGludApAQCAtNDE2LDExICs0NDAs
MjEgQEAgc3RhdGljIHN0cnVjdCBjbG50X3VwY2FsbF9pbmZvICphbGxvY191cGNhbGxfaW5m
byhzdHJ1Y3QgY2xudF9pbmZvICpjbHApCiAJaW5mbyA9IG1hbGxvYyhzaXplb2Yoc3RydWN0
IGNsbnRfdXBjYWxsX2luZm8pKTsKIAlpZiAoaW5mbyA9PSBOVUxMKQogCQlyZXR1cm4gTlVM
TDsKKworCXB0aHJlYWRfbXV0ZXhfbG9jaygmY2xwX2xvY2spOworCWNscC0+cmVmY291bnQr
KzsKKwlwdGhyZWFkX211dGV4X3VubG9jaygmY2xwX2xvY2spOwogCWluZm8tPmNscCA9IGNs
cDsKIAogCXJldHVybiBpbmZvOwogfQogCit2b2lkIGZyZWVfdXBjYWxsX2luZm8oc3RydWN0
IGNsbnRfdXBjYWxsX2luZm8gKmluZm8pCit7CisJZ3NzZF9mcmVlX2NsaWVudChpbmZvLT5j
bHApOworCWZyZWUoaW5mbyk7Cit9CisKIC8qIEZvciBlYWNoIHVwY2FsbCByZWFkIHRoZSB1
cGNhbGwgaW5mbyBpbnRvIHRoZSBidWZmZXIsIHRoZW4gY3JlYXRlIGEKICAqIHRocmVhZCBp
biBhIGRldGFjaGVkIHN0YXRlIHNvIHRoYXQgcmVzb3VyY2VzIGFyZSByZWxlYXNlZCBiYWNr
IGludG8KICAqIHRoZSBzeXN0ZW0gd2l0aG91dCB0aGUgbmVlZCBmb3IgYSBqb2luLgpAQCAt
NDM4LDEzICs0NzIsMTMgQEAgZ3NzZF9jbG50X2dzc2RfY2IoaW50IFVOVVNFRChmZCksIHNo
b3J0IFVOVVNFRCh3aGljaCksIHZvaWQgKmRhdGEpCiAJaW5mby0+bGJ1ZmxlbiA9IHJlYWQo
Y2xwLT5nc3NkX2ZkLCBpbmZvLT5sYnVmLCBzaXplb2YoaW5mby0+bGJ1ZikpOwogCWlmIChp
bmZvLT5sYnVmbGVuIDw9IDAgfHwgaW5mby0+bGJ1ZltpbmZvLT5sYnVmbGVuLTFdICE9ICdc
bicpIHsKIAkJcHJpbnRlcnIoMCwgIldBUk5JTkc6ICVzOiBmYWlsZWQgcmVhZGluZyByZXF1
ZXN0XG4iLCBfX2Z1bmNfXyk7Ci0JCWZyZWUoaW5mbyk7CisJCWZyZWVfdXBjYWxsX2luZm8o
aW5mbyk7CiAJCXJldHVybjsKIAl9CiAJaW5mby0+bGJ1ZltpbmZvLT5sYnVmbGVuLTFdID0g
MDsKIAogCWlmIChzdGFydF91cGNhbGxfdGhyZWFkKGhhbmRsZV9nc3NkX3VwY2FsbCwgaW5m
bykpCi0JCWZyZWUoaW5mbyk7CisJCWZyZWVfdXBjYWxsX2luZm8oaW5mbyk7CiB9CiAKIHN0
YXRpYyB2b2lkCkBAIC00NjEsMTIgKzQ5NSwxMiBAQCBnc3NkX2NsbnRfa3JiNV9jYihpbnQg
VU5VU0VEKGZkKSwgc2hvcnQgVU5VU0VEKHdoaWNoKSwgdm9pZCAqZGF0YSkKIAkJCXNpemVv
ZihpbmZvLT51aWQpKSA8IChzc2l6ZV90KXNpemVvZihpbmZvLT51aWQpKSB7CiAJCXByaW50
ZXJyKDAsICJXQVJOSU5HOiAlczogZmFpbGVkIHJlYWRpbmcgdWlkIGZyb20ga3JiNSAiCiAJ
CQkgInVwY2FsbCBwaXBlOiAlc1xuIiwgX19mdW5jX18sIHN0cmVycm9yKGVycm5vKSk7Ci0J
CWZyZWUoaW5mbyk7CisJCWZyZWVfdXBjYWxsX2luZm8oaW5mbyk7CiAJCXJldHVybjsKIAl9
CiAKIAlpZiAoc3RhcnRfdXBjYWxsX3RocmVhZChoYW5kbGVfa3JiNV91cGNhbGwsIGluZm8p
KQotCQlmcmVlKGluZm8pOworCQlmcmVlX3VwY2FsbF9pbmZvKGluZm8pOwogfQogCiBzdGF0
aWMgc3RydWN0IGNsbnRfaW5mbyAqCkBAIC01MDEsNiArNTM1LDcgQEAgZ3NzZF9nZXRfY2xu
dChzdHJ1Y3QgdG9wZGlyICp0ZGksIGNvbnN0IGNoYXIgKm5hbWUpCiAJY2xwLT5uYW1lID0g
Y2xwLT5yZWxwYXRoICsgc3RybGVuKHRkaS0+bmFtZSkgKyAxOwogCWNscC0+a3JiNV9mZCA9
IC0xOwogCWNscC0+Z3NzZF9mZCA9IC0xOworCWNscC0+cmVmY291bnQgPSAxOwogCiAJVEFJ
TFFfSU5TRVJUX0hFQUQoJnRkaS0+Y2xudF9saXN0LCBjbHAsIGxpc3QpOwogCXJldHVybiBj
bHA7CkBAIC02NTEsNyArNjg2LDcgQEAgZ3NzZF9zY2FuX3RvcGRpcihjb25zdCBjaGFyICpu
YW1lKQogCQlpZiAoY2xwLT5zY2FubmVkKQogCQkJY29udGludWU7CiAKLQkJcHJpbnRlcnIo
MywgImRlc3Ryb3lpbmcgY2xpZW50ICVzXG4iLCBjbHAtPnJlbHBhdGgpOworCQlwcmludGVy
cigzLCAib3JwaGFuZWQgY2xpZW50ICVzXG4iLCBjbHAtPnJlbHBhdGgpOwogCQlzYXZlcHJl
diA9IGNscC0+bGlzdC50cWVfcHJldjsKIAkJVEFJTFFfUkVNT1ZFKCZ0ZGktPmNsbnRfbGlz
dCwgY2xwLCBsaXN0KTsKIAkJZ3NzZF9kZXN0cm95X2NsaWVudChjbHApOwpkaWZmIC0tZ2l0
IGEvdXRpbHMvZ3NzZC9nc3NkLmggYi91dGlscy9nc3NkL2dzc2QuaAppbmRleCBmNGY1OTc1
NC4uZDMzZTRkZmYgMTAwNjQ0Ci0tLSBhL3V0aWxzL2dzc2QvZ3NzZC5oCisrKyBiL3V0aWxz
L2dzc2QvZ3NzZC5oCkBAIC02MywxMiArNjMsMTAgQEAgZXh0ZXJuIHVuc2lnbmVkIGludCAJ
CWNvbnRleHRfdGltZW91dDsKIGV4dGVybiB1bnNpZ25lZCBpbnQgcnBjX3RpbWVvdXQ7CiBl
eHRlcm4gY2hhcgkJCSpwcmVmZXJyZWRfcmVhbG07CiBleHRlcm4gcHRocmVhZF9tdXRleF90
IHBsZV9sb2NrOwotZXh0ZXJuIHB0aHJlYWRfY29uZF90IHBjb25kOwotZXh0ZXJuIHB0aHJl
YWRfbXV0ZXhfdCBwbXV0ZXg7Ci1leHRlcm4gaW50IHRocmVhZF9zdGFydGVkOwogCiBzdHJ1
Y3QgY2xudF9pbmZvIHsKIAlUQUlMUV9FTlRSWShjbG50X2luZm8pCWxpc3Q7CisJaW50CQkJ
cmVmY291bnQ7CiAJaW50CQkJd2Q7CiAJYm9vbAkJCXNjYW5uZWQ7CiAJY2hhcgkJCSpuYW1l
OwpAQCAtOTQsNiArOTIsNyBAQCBzdHJ1Y3QgY2xudF91cGNhbGxfaW5mbyB7CiAKIHZvaWQg
aGFuZGxlX2tyYjVfdXBjYWxsKHN0cnVjdCBjbG50X3VwY2FsbF9pbmZvICpjbHApOwogdm9p
ZCBoYW5kbGVfZ3NzZF91cGNhbGwoc3RydWN0IGNsbnRfdXBjYWxsX2luZm8gKmNscCk7Cit2
b2lkIGZyZWVfdXBjYWxsX2luZm8oc3RydWN0IGNsbnRfdXBjYWxsX2luZm8gKmluZm8pOwog
CiAKICNlbmRpZiAvKiBfUlBDX0dTU0RfSF8gKi8KZGlmZiAtLWdpdCBhL3V0aWxzL2dzc2Qv
Z3NzZF9wcm9jLmMgYi91dGlscy9nc3NkL2dzc2RfcHJvYy5jCmluZGV4IDhmZTY2MDViLi4w
NWMxZGE2NCAxMDA2NDQKLS0tIGEvdXRpbHMvZ3NzZC9nc3NkX3Byb2MuYworKysgYi91dGls
cy9nc3NkL2dzc2RfcHJvYy5jCkBAIC03MzAsNyArNzMwLDcgQEAgaGFuZGxlX2tyYjVfdXBj
YWxsKHN0cnVjdCBjbG50X3VwY2FsbF9pbmZvICppbmZvKQogCXByaW50ZXJyKDIsICJcbiVz
OiB1aWQgJWQgKCVzKVxuIiwgX19mdW5jX18sIGluZm8tPnVpZCwgY2xwLT5yZWxwYXRoKTsK
IAogCXByb2Nlc3Nfa3JiNV91cGNhbGwoY2xwLCBpbmZvLT51aWQsIGNscC0+a3JiNV9mZCwg
TlVMTCwgTlVMTCwgTlVMTCk7Ci0JZnJlZShpbmZvKTsKKwlmcmVlX3VwY2FsbF9pbmZvKGlu
Zm8pOwogfQogCiB2b2lkCkBAIC04MzAsNiArODMwLDYgQEAgaGFuZGxlX2dzc2RfdXBjYWxs
KHN0cnVjdCBjbG50X3VwY2FsbF9pbmZvICppbmZvKQogb3V0OgogCWZyZWUodXBjYWxsX3N0
cik7CiBvdXRfbm9tZW06Ci0JZnJlZShpbmZvKTsKKwlmcmVlX3VwY2FsbF9pbmZvKGluZm8p
OwogCXJldHVybjsKIH0KLS0gCjIuMjYuMgoK
--------------C76790290F3F872CF2D00FA5--