Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "J. R. Okajima" <hooanon05g@gmail.com>
To:     neilb@suse.de, trond.myklebust@hammerspace.com
Cc:     linux-nfs@vger.kernel.org
Subject: NFS, two d_delete() calls in nfs_unlink()
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <7633.1660728564.1@jrobl>
Date:   Wed, 17 Aug 2022 18:29:24 +0900
Message-ID: <7634.1660728564@jrobl>
Precedence: bulk

Hello NeilBrown and Trond Myklebust,

By the commin in v6.0-rc1,
	3c59366c207e 2022-08-08 NFS: don't unhash dentry during unlink/rename
nfs_unlink() stopped calling __d_drop().
And it MAY cause two d_delete() calls. If it happens, the second call
leads to NULL pointer access because d_inode is already cleared.

Here is the detail.

nfs_unlink()
+ nfs_safe_remove()
  + NFS_PROTO(dir)->remove() <-- returns ENOENT
  + nfs_dentry_handle_enoent()
    + if (simple_positive()) d_delete() <-- 1st call and d_inode is cleared
+ nfs_dentry_remove_handle_error()
  + if (ENOENT) d_delete() <-- second call and NULL d_inode is accessed

How about adding a condition for d_delete() call in
nfs_dentry_remove_handle_error(), such like simple_positive()?


J. R. Okajima