Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <63286cf2604c30671e9cc2b73467f28e9dd96064.camel@kernel.org>
Subject: Re: [PATCH 1/3] nfsd: nfsd_do_file_acquire should hold
 rcu_read_lock while getting refs
From:   Jeff Layton <jlayton@kernel.org>
To:     NeilBrown <neilb@suse.de>
Cc:     chuck.lever@oracle.com, linux-nfs@vger.kernel.org
Date:   Sat, 01 Oct 2022 05:47:40 -0400
In-Reply-To: <166459949085.17572.9387753773056673569@noble.neil.brown.name>
References: <20220930191550.172087-1-jlayton@kernel.org>
        , <20220930191550.172087-2-jlayton@kernel.org>
         <166459949085.17572.9387753773056673569@noble.neil.brown.name>
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4 (3.44.4-2.fc36) 
MIME-Version: 1.0
Precedence: bulk

On Sat, 2022-10-01 at 14:44 +1000, NeilBrown wrote:
> On Sat, 01 Oct 2022, Jeff Layton wrote:
> > nfsd_file is RCU-freed, so it's possible that one could be found that's
> > in the process of being freed and the memory recycled. Ensure we hold
> > the rcu_read_lock while attempting to get a reference on the object.
> >=20
> > Signed-off-by: Jeff Layton <jlayton@kernel.org>
> > ---
> >  fs/nfsd/filecache.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> >=20
> > diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> > index d5c57360b418..6237715bd23e 100644
> > --- a/fs/nfsd/filecache.c
> > +++ b/fs/nfsd/filecache.c
> > @@ -1077,10 +1077,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, st=
ruct svc_fh *fhp,
> > =20
> >  retry:
> >  	/* Avoid allocation if the item is already in cache */
> > +	rcu_read_lock();
> >  	nf =3D rhashtable_lookup_fast(&nfsd_file_rhash_tbl, &key,
> >  				    nfsd_file_rhash_params);
> >  	if (nf)
> >  		nf =3D nfsd_file_get(nf);
> > +	rcu_read_unlock();
>=20
> Looks good.
>=20
> >  	if (nf)
> >  		goto wait_for_construction;
> > =20
> > @@ -1090,16 +1092,21 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, st=
ruct svc_fh *fhp,
> >  		goto out_status;
> >  	}
> > =20
> > +	rcu_read_lock();
> >  	nf =3D rhashtable_lookup_get_insert_key(&nfsd_file_rhash_tbl,
> >  					      &key, &new->nf_rhash,
> >  					      nfsd_file_rhash_params);
> >  	if (!nf) {
> > +		rcu_read_unlock();
> >  		nf =3D new;
> >  		goto open_file;
> >  	}
> > -	if (IS_ERR(nf))
> > +	if (IS_ERR(nf)) {
> > +		rcu_read_unlock();
> >  		goto insert_err;
> > +	}
> >  	nf =3D nfsd_file_get(nf);
> > +	rcu_read_unlock();
>=20
> Ugh.
> Could we make this:
>    rcu_read_lock()
>    nf =3D r_l_g_i_k()
>    if (!IS_ERR_OR_NULL(nf))
>         nf =3D nfsd_file_get(nf);
>    rcu_read_unlock()
>    ...
> ??
>=20
> NeilBrown
>=20

Good point. I'll resend a v2 here.

> >  	if (nf =3D=3D NULL) {
> >  		nf =3D new;
> >  		goto open_file;
> > --=20
> > 2.37.3
> >=20
> >=20

--=20
Jeff Layton <jlayton@kernel.org>