Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "Jeff Layton" <jlayton@kernel.org>
Cc:     chuck.lever@oracle.com, linux-nfs@vger.kernel.org
Subject: Re: [PATCH 1/3] nfsd: nfsd_do_file_acquire should hold rcu_read_lock
 while getting refs
In-reply-to: <20220930191550.172087-2-jlayton@kernel.org>
References: <20220930191550.172087-1-jlayton@kernel.org>,
 <20220930191550.172087-2-jlayton@kernel.org>
Date:   Sat, 01 Oct 2022 14:44:50 +1000
Message-id: <166459949085.17572.9387753773056673569@noble.neil.brown.name>
Precedence: bulk

On Sat, 01 Oct 2022, Jeff Layton wrote:
> nfsd_file is RCU-freed, so it's possible that one could be found that's
> in the process of being freed and the memory recycled. Ensure we hold
> the rcu_read_lock while attempting to get a reference on the object.
>=20
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
>  fs/nfsd/filecache.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>=20
> diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> index d5c57360b418..6237715bd23e 100644
> --- a/fs/nfsd/filecache.c
> +++ b/fs/nfsd/filecache.c
> @@ -1077,10 +1077,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct=
 svc_fh *fhp,
> =20
>  retry:
>  	/* Avoid allocation if the item is already in cache */
> +	rcu_read_lock();
>  	nf =3D rhashtable_lookup_fast(&nfsd_file_rhash_tbl, &key,
>  				    nfsd_file_rhash_params);
>  	if (nf)
>  		nf =3D nfsd_file_get(nf);
> +	rcu_read_unlock();

Looks good.

>  	if (nf)
>  		goto wait_for_construction;
> =20
> @@ -1090,16 +1092,21 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct=
 svc_fh *fhp,
>  		goto out_status;
>  	}
> =20
> +	rcu_read_lock();
>  	nf =3D rhashtable_lookup_get_insert_key(&nfsd_file_rhash_tbl,
>  					      &key, &new->nf_rhash,
>  					      nfsd_file_rhash_params);
>  	if (!nf) {
> +		rcu_read_unlock();
>  		nf =3D new;
>  		goto open_file;
>  	}
> -	if (IS_ERR(nf))
> +	if (IS_ERR(nf)) {
> +		rcu_read_unlock();
>  		goto insert_err;
> +	}
>  	nf =3D nfsd_file_get(nf);
> +	rcu_read_unlock();

Ugh.
Could we make this:
   rcu_read_lock()
   nf =3D r_l_g_i_k()
   if (!IS_ERR_OR_NULL(nf))
        nf =3D nfsd_file_get(nf);
   rcu_read_unlock()
   ...
??

NeilBrown

>  	if (nf =3D=3D NULL) {
>  		nf =3D new;
>  		goto open_file;
> --=20
> 2.37.3
>=20
>=20