Re: NLM 4 Infinite Loop Bug

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




> On Jul 27, 2022, at 1:20 PM, Jan Kasiak <j.kasiak@xxxxxxxxx> wrote:
> 
> Hi Chuck,
> 
> I created 3 bugs:
> 
> https://bugzilla.linux-nfs.org/show_bug.cgi?id=390
> For the original issue I reported with FREE_ALL
> because I'm not sure if its fully fixed.
> 
> https://bugzilla.linux-nfs.org/show_bug.cgi?id=391
> For scenario A
> 
> https://bugzilla.linux-nfs.org/show_bug.cgi?id=392
> For scenario B/C because they are very similar

Thanks. Jeff and I will have a look at these soon.


> Thanks,
> -Jan
> 
> On Tue, Jul 26, 2022 at 1:34 PM Chuck Lever III <chuck.lever@xxxxxxxxxx> wrote:
>> 
>> Hello Jan-
>> 
>>> On Jul 26, 2022, at 1:16 PM, Jan Kasiak <j.kasiak@xxxxxxxxx> wrote:
>>> 
>>> Hi all,
>>> 
>>> Even after applying the above two patches, I have discovered a new set
>>> of NLM 4 requests that break lockd.
>>> 
>>> Unfortunately, I don't have enough experience to suggest a fix, but
>>> would be glad to test anyone's attempt.
>>> 
>>> All requests are non-blocking.
>>> 
>>> Scenario A
>>> =========
>>> lock(offset=UINT64_MAX, len=100) - GRANTED
>>> free_all() - never finishes and lockd thread is stuck busy looping
>>> 
>>> Scenario B
>>> ========
>>> lock(svid=1, offset=UINT64_MAX, len=100) - GRANTED
>>> 
>>> test(svid=2, offset=UINT64_MAX, len=50) - DENIED
>>> correct, holder offset, len are (UINT64_MAX, 100)
>>> 
>>> test(svid=2, offset=75, len=10) - DENIED
>>> wrong, because holder (offset, len) are wrong (UINT64_MAX, 100),
>>> because the above
>>> lock overflows during comparison to (49, 50)
>>> 
>>> Scenario C
>>> ========
>>> lock(svid=1, offset=UINT64_MAX, len=100) - GRANTED
>>> 
>>> test(svid=2, offset=UINT64_MAX, len=50) - DENIED
>>> correct, holder offset, len are (UINT64_MAX, 100)
>>> 
>>> unlock(svid=1, offset=UINT64_MAX, len=50) - GRANTED
>>> weird, because it has now created a lock at (offset=UINT64_MAX + 50, len=50)
>>> not sure what the correct behavior should be here - FBIG error?
>>> 
>>> test(svid=2, offset=75, len=10) - DENIED
>>> wrong, because holder offset, len are wrong (49, 50), because the above
>>> unlock has overflowed the offset
>> 
>> Thanks for testing.
>> 
>> May I ask that you file these as three separate bugs here:
>> 
>> https://bugzilla.linux-nfs.org/
>> 
>> 
>> 
>> --
>> Chuck Lever
>> 
>> 
>> 

--
Chuck Lever







[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux