Re: [PATCH] SUNRPC: fix use-after-free of rpc pipes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



27.02.2012 03:52, Myklebust, Trond пишет:
On Fri, 2012-02-24 at 22:14 +0400, Stanislav Kinsbursky wrote:
23.02.2012 21:48, Fred Isaman пишет:
This needs to be looked at closely by someone more familiar with the
pipe code.

It fixes an issue with the current nfs_for_next branch which causes a
chain of oopses on umount every time if sufficient CONFIG_* debug
options are set.

A git-bisect shows that the problem was introduced by
commit c239d83b  SUNRPC: split SUNPRC PipeFS dentry and private pipe data creation




Fred, thanks for the config.
The problem is caused by destroying pipe data on NFS client umount after
unlinking pipe dentry. This is valid approach, but it looks like idmap daemon
holds dentry by eventfd.
This is a race between idmap daemon release of this dentry and releasing of pipe
data...
I need some time to find out how to fix this properly.


How about something like the following (still untested) patch?

Cheers
   Trond


Hi, Trond. Thanks for participating.
Frankly, I don't like the idea of put'ing pipe data on dentry unlink. IOW, I don't like that this data will be controlled somehow in PipeFS.
I'll send my version soon.

--
Best regards,
Stanislav Kinsbursky
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux