Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 2 Jun 2021 16:04:07 -0400
From:   "J. Bruce Fields" <bfields@fieldses.org>
To:     David Wysochanski <dwysocha@redhat.com>
Cc:     linux-nfs <linux-nfs@vger.kernel.org>
Subject: Re: BUG: KASAN: use-after-free in
 find_clp_in_name_tree.isra.0+0x13e/0x190 [nfsd]
Message-ID: <20210602200407.GB6995@fieldses.org>
References: <CALF+zOnw_6i2M0gv4rZYURdZgO8e84ja8u_7yEMnMz=3n+hKJg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CALF+zOnw_6i2M0gv4rZYURdZgO8e84ja8u_7yEMnMz=3n+hKJg@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk

On Wed, Jun 02, 2021 at 02:13:02PM -0400, David Wysochanski wrote:
> I was testing your nfsd-next branch (plus my modified v3 callback
> address and state patch I just sent) and saw this on console after a
> simple test of mount, umount, mount cycle of a NFSv4.1 mount.

Oops, thanks, it just needs this, I think; maybe I'd've caught that bug
earlier if I'd actually posted that patch.  Doing that now....

--b.

commit 70d6ebca5248
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Wed Jun 2 15:50:45 2021 -0400

    foldme

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 967912b4a7dd..6c64ce93510f 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2841,6 +2841,7 @@ move_to_confirmed(struct nfs4_client *clp)
 	list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
 	rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
 	add_clp_to_name_tree(clp, &nn->conf_name_tree);
+	set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
 	trace_nfsd_clid_confirmed(&clp->cl_clientid);
 	renew_client_locked(clp);
 }