Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "Jeff Layton" <jlayton@kernel.org>
Cc:     chuck.lever@oracle.com, linux-nfs@vger.kernel.org
Subject: Re: [PATCH] nfsd: fix potential race in nfs4_find_file
In-reply-to: <20230105121823.21935-1-jlayton@kernel.org>
References: <20230105121823.21935-1-jlayton@kernel.org>
Date:   Fri, 06 Jan 2023 10:05:31 +1100
Message-id: <167295993121.13974.8791979932693514625@noble.neil.brown.name>
Precedence: bulk

On Thu, 05 Jan 2023, Jeff Layton wrote:
> Even though there is a WARN_ON_ONCE check, it seems possible for
> nfs4_find_file to race with the destruction of an fi_deleg_file while
> trying to take a reference to it.
>=20
> put_deleg_file is done while holding the fi_lock. Take and hold it
> when dealing with the fi_deleg_file in nfs4_find_file.
>=20
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
>  fs/nfsd/nfs4state.c | 16 ++++++++++------
>  1 file changed, 10 insertions(+), 6 deletions(-)
>=20
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index b68238024e49..3df3ae84bd07 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -6417,23 +6417,27 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *c=
state,
>  static struct nfsd_file *
>  nfs4_find_file(struct nfs4_stid *s, int flags)
>  {
> +	struct nfsd_file *ret =3D NULL;
> +
>  	if (!s)
>  		return NULL;
> =20
>  	switch (s->sc_type) {
>  	case NFS4_DELEG_STID:
> -		if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
> -			return NULL;
> -		return nfsd_file_get(s->sc_file->fi_deleg_file);
> +		spin_lock(&s->sc_file->fi_lock);
> +		if (!WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
> +			ret =3D nfsd_file_get(s->sc_file->fi_deleg_file);
> +		spin_unlock(&s->sc_file->fi_lock);
> +		break;

As an nfsd_file is freed with rcu, we don't need the spinlock.

 rcu_read_lock()
 ret =3D rcu_dereference(s->sc_file->fi_deleg_file);
 if (ret)
	ret =3D nfsd_file_get(ret);
 rcu_read_unlock();

You could even put the NULL test in nfsd_file_get() and have:

 rcu_read_lock()l;
 ret =3D nfsd_file_get(rcu_dereference(s->sc_file->fi_deleg_file));
 rcu_read_unlock();

but that might not be a win.

I agree with Chuck that the WARNing isn't helpful.

NeilBrown


>  	case NFS4_OPEN_STID:
>  	case NFS4_LOCK_STID:
>  		if (flags & RD_STATE)
> -			return find_readable_file(s->sc_file);
> +			ret =3D find_readable_file(s->sc_file);
>  		else
> -			return find_writeable_file(s->sc_file);
> +			ret =3D find_writeable_file(s->sc_file);
>  	}
> =20
> -	return NULL;
> +	return ret;
>  }
> =20
>  static __be32
> --=20
> 2.39.0
>=20
>=20