Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Jeff Layton <jlayton@kernel.org>
Subject: [GIT PULL] 2nd v6.2 PR for nfsd
Thread-Topic: [GIT PULL] 2nd v6.2 PR for nfsd
Thread-Index: AQHZE7T1deE3iCH3T027oSp1xpLwjg==
Date:   Mon, 19 Dec 2022 14:19:51 +0000
Message-ID: <B9418BA0-EBAC-4CE4-AA12-206083581C42@oracle.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?5+1RPaw5ffwUbbY/swLWpqJlGqeN3VzszRVh2deKdqh5O3xhb9UDAfYSnyN2?=
 =?us-ascii?Q?oGox/A4YfG7P/gRYDTaLrGCHV5X/Qj8yFqpwYB+WbZalcJWyy0tzUGeCaiZR?=
 =?us-ascii?Q?hz+c9sTjaBO1oahQ4xCxM5ZuhTZXt7ELfDwYv7U31kEI09i+7fFcthW2zRbR?=
 =?us-ascii?Q?09TsFHeqbYHVBHofK2DyFdIRS2BITTVsciRu53wCSQJ64Lf29IMsbQBAM2U2?=
 =?us-ascii?Q?ipGzDr3Ly42VwzOMMshqjl0WMZ08pbBeLogU2MUHocZZI50Fnk1wBLmmZ0eO?=
 =?us-ascii?Q?XU1Sslecu80/V5yrHNBXpuOJyGarV8l8Ir1Hc+NkxPD7NitsINH8uJo44/yJ?=
 =?us-ascii?Q?3XwgyHa5hKZssa5YQf4uHuVtg4WDYbeQoQV5cGFS3rFbaiyW82NLMqy0RfzR?=
 =?us-ascii?Q?3eYNeBdrMxFCaWuTEQiK/pDiJmSBvsDEHk2TddPnNWgI7p9IGEszEOnqewc/?=
 =?us-ascii?Q?jKVpPwm+PvPz01ZpXumhzK8FAawB+2egB/h99M/0Zz07FEXz4ArlBsTLzJJD?=
 =?us-ascii?Q?o9CBeBQ4IfDMZCucaBZq4SUZYBlSCZgr2Ot8QUTp6IvyR+pL20MvS+XjXQcM?=
 =?us-ascii?Q?GUja1iKM6uIErfYNUZ93I6Dkn6yAgTrJ1+Sxv6eNWjKVPEwi8WDUv/55Z0S2?=
 =?us-ascii?Q?1DPICZ+OR8RolH1j3BN4WwwQBAViozcViAbE1BxQsFkvoysj4TI69rIOrZ67?=
 =?us-ascii?Q?NUny06t+lBnuPPevmrIvbEtSVlZFpWM95pLRfuIR8cAfloIuIuQKf9wUJGDb?=
 =?us-ascii?Q?v9CafpzU1Pn4fiMgg3vvuUXLcpdoTRTvjv6YndkKFV3sKG2fcziJLJvREjOM?=
 =?us-ascii?Q?4+Vo11Zkl3QwZJHXkIF8GxXCPyEeEXroUuLxhd0P9JREFYjjd3xY3TWmYwEL?=
 =?us-ascii?Q?T5h84TPF64fZ11ldrALuKsW3WNSGQl0robJ/X2KT8crw55YVmAuHuWeO+evr?=
 =?us-ascii?Q?W2fJGtv7DyFgIj3xEpV2Lnj++xDLPmnwUAQXMs9WV4HvmjSOveuf7gwhw3WK?=
 =?us-ascii?Q?4CtT7hkUy5b5IXtzTEz7PpLkfAijjVfFFllflq0iuTmN1vFAdXMzBfhWn284?=
 =?us-ascii?Q?Hfvxbqyo/8Lu3U0I1hHYV+LmcstoCq4UhMz39rvZqmla/OFhO6VlVqsZveNK?=
 =?us-ascii?Q?vV/VaRl6kEFdh1QZWuEW5/2Birc/BeDkk360bwj9JtgKLCegEoxCY50foflb?=
 =?us-ascii?Q?+NXbOFnTeoVq+QzDrAb9EPV6Xd/fBJnJLB2WK3tqV5yaImgoChgQpVRZKu5s?=
 =?us-ascii?Q?aBc4p/qL6rFGQU1tMN91Q5k+KoXaNwCHQQOh2g5crOlqPhF3Z1yb3T/5DyVI?=
 =?us-ascii?Q?EAyacuBLj7Z3io2/ypVC+wXYUUP4aChjvPozKou4OYJQNn+aq5dA60Dn9ptt?=
 =?us-ascii?Q?QpbR+5oMIIf3c3Wrl8RtlZSDAiUdiC497y7kGdDEd4y/thZ+2SuFMn/Ggynx?=
 =?us-ascii?Q?JnJNAjSdgOVanbwoPAef/VJ56LJBigKehXyg00CjJFR3VEIn089TVk+wR4Fj?=
 =?us-ascii?Q?FV/JmN4drVO12PLphQ35yR29GwIl5Y3RxVtXXmYnhjBYzGY4nU/3p1BXUtHr?=
 =?us-ascii?Q?/uvkU4pab4mo45JIqx0zG4GYZD53ESE/ytG2Lg4YbLniIZI1EnLzZnNX7pd8?=
 =?us-ascii?Q?zQ=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <CD0334CCEBB7294190D5E262CB25B2B7@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5134.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 206b993a-3133-4336-6c56-08dae1cc181a
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2022 14:19:51.9840
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: IMZM1wz1j47NkHxtqrK5y/R5dqh79WpMeJGRjl0nKs2A8VTuTMl4QTzqyCP4DbfnWfwRKBuBcrQeiWeBSoBJpA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4527
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-19_01,2022-12-15_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 phishscore=0 suspectscore=0
 adultscore=0 malwarescore=0 spamscore=0 mlxlogscore=999 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000
 definitions=main-2212190127
X-Proofpoint-GUID: 1NTItqTY70ZujdpkaQasEynDmXOV47p4
X-Proofpoint-ORIG-GUID: 1NTItqTY70ZujdpkaQasEynDmXOV47p4
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

Hello Linus-

This pull request contains a number of crasher fixes that were not ready
for the initial pull request last week.

In particular, Jeff's patch attempts to address reference count underflows
in NFSD's filecache, which have been very difficult to track down because
there is no reliable reproducer.

Common failure modes:
- https://bugzilla.kernel.org/show_bug.cgi?id=3D216691#c11
- https://bugzilla.kernel.org/show_bug.cgi?id=3D216674#c6
- https://bugzilla.redhat.com/show_bug.cgi?id=3D2138605

The race windows were found by inspection and the clean-ups appear sensible
and pass regression testing, so we include them here in the hope that they
address the problem. However we remain vigilant because we don't have 100%
certainty yet that the problem is fully addressed.


--- Pull request follows ---

The following changes since commit e78e274eb22d966258a3845acc71d3c5b8ee2ea8=
:

  NFSD: Avoid clashing function prototypes (2022-12-10 11:01:13 -0500)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git tags/nfsd-6=
.2-1

for you to fetch changes up to 75333d48f92256a0dec91dbf07835e804fc411c0:

  NFSD: fix use-after-free in __nfs42_ssc_open() (2022-12-14 10:11:54 -0500=
)

----------------------------------------------------------------
nfsd-6.2 supplement:
- Address numerous reports of refcount underflows in NFSD's filecache
- Address a UAF in callback setup error handling
- Address a UAF during server-to-server copy

----------------------------------------------------------------
Dai Ngo (1):
      NFSD: fix use-after-free in __nfs42_ssc_open()

Dan Aloni (1):
      nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure

Jeff Layton (1):
      nfsd: rework refcounting in filecache

 fs/nfsd/filecache.c    | 328 +++++++++++++++++++++++++++++++++++++++++++++=
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----------=
---------------------------------------------------------------------------=
----------
 fs/nfsd/nfs4callback.c |   4 ++-
 fs/nfsd/nfs4proc.c     |  20 ++++---------
 fs/nfsd/trace.h        |  51 ++++++++++++--------------------
 4 files changed, 202 insertions(+), 201 deletions(-)

--
Chuck Lever