Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <20221117115023.1350181-2-dwysocha@redhat.com>
References: <20221117115023.1350181-2-dwysocha@redhat.com> <20221117115023.1350181-1-dwysocha@redhat.com>
To:     Dave Wysochanski <dwysocha@redhat.com>
Cc:     dhowells@redhat.com, Daire Byrne <daire.byrne@gmail.com>,
        Benjamin Maynard <benmaynard@google.com>,
        linux-cachefs@redhat.com, linux-nfs@vger.kernel.org
Subject: Re: [PATCH 1/1] fscache: Fix oops due to race with cookie_lru and use_cookie
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3715747.1668691837.1@warthog.procyon.org.uk>
Date:   Thu, 17 Nov 2022 13:30:37 +0000
Message-ID: <3715748.1668691837@warthog.procyon.org.uk>
Precedence: bulk

Dave Wysochanski <dwysocha@redhat.com> wrote:

> If a cookie expires from the LRU and the LRU_DISCARD flag is set,
> but the state machine has not run yet, it's possible another thread
> can call fscache_use_cookie and begin to use it.  When the
> cookie_worker finally runs, it will see the LRU_DISCARD flag set,
> transition the cookie->state to LRU_DISCARDING, which will then
> withdraw the cookie.  Once the cookie is withdrawn the object is
> removed the below oops will occur because the object associated
> with the cookie is now NULL.
> 
> Fix the oops by clearing the LRU_DISCARD bit if another thread
> uses the cookie before the cookie_worker runs.

I think this is the right approach.  The state machine should just fall
through without doing anything, despite having been woken.

David