On Sat, 01 Oct 2022, Jeff Layton wrote:
> nfsd_file is RCU-freed, so it's possible that one could be found that's
> in the process of being freed and the memory recycled. Ensure we hold
> the rcu_read_lock while attempting to get a reference on the object.
>
> Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
> ---
> fs/nfsd/filecache.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> index d5c57360b418..6237715bd23e 100644
> --- a/fs/nfsd/filecache.c
> +++ b/fs/nfsd/filecache.c
> @@ -1077,10 +1077,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
>
> retry:
> /* Avoid allocation if the item is already in cache */
> + rcu_read_lock();
> nf = rhashtable_lookup_fast(&nfsd_file_rhash_tbl, &key,
> nfsd_file_rhash_params);
> if (nf)
> nf = nfsd_file_get(nf);
> + rcu_read_unlock();
Looks good.
> if (nf)
> goto wait_for_construction;
>
> @@ -1090,16 +1092,21 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
> goto out_status;
> }
>
> + rcu_read_lock();
> nf = rhashtable_lookup_get_insert_key(&nfsd_file_rhash_tbl,
> &key, &new->nf_rhash,
> nfsd_file_rhash_params);
> if (!nf) {
> + rcu_read_unlock();
> nf = new;
> goto open_file;
> }
> - if (IS_ERR(nf))
> + if (IS_ERR(nf)) {
> + rcu_read_unlock();
> goto insert_err;
> + }
> nf = nfsd_file_get(nf);
> + rcu_read_unlock();
Ugh.
Could we make this:
rcu_read_lock()
nf = r_l_g_i_k()
if (!IS_ERR_OR_NULL(nf))
nf = nfsd_file_get(nf);
rcu_read_unlock()
...
??
NeilBrown
> if (nf == NULL) {
> nf = new;
> goto open_file;
> --
> 2.37.3
>
>
