On Sat, 2022-10-01 at 14:44 +1000, NeilBrown wrote:
> On Sat, 01 Oct 2022, Jeff Layton wrote:
> > nfsd_file is RCU-freed, so it's possible that one could be found that's
> > in the process of being freed and the memory recycled. Ensure we hold
> > the rcu_read_lock while attempting to get a reference on the object.
> >
> > Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
> > ---
> > fs/nfsd/filecache.c | 9 ++++++++-
> > 1 file changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
> > index d5c57360b418..6237715bd23e 100644
> > --- a/fs/nfsd/filecache.c
> > +++ b/fs/nfsd/filecache.c
> > @@ -1077,10 +1077,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
> >
> > retry:
> > /* Avoid allocation if the item is already in cache */
> > + rcu_read_lock();
> > nf = rhashtable_lookup_fast(&nfsd_file_rhash_tbl, &key,
> > nfsd_file_rhash_params);
> > if (nf)
> > nf = nfsd_file_get(nf);
> > + rcu_read_unlock();
>
> Looks good.
>
> > if (nf)
> > goto wait_for_construction;
> >
> > @@ -1090,16 +1092,21 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
> > goto out_status;
> > }
> >
> > + rcu_read_lock();
> > nf = rhashtable_lookup_get_insert_key(&nfsd_file_rhash_tbl,
> > &key, &new->nf_rhash,
> > nfsd_file_rhash_params);
> > if (!nf) {
> > + rcu_read_unlock();
> > nf = new;
> > goto open_file;
> > }
> > - if (IS_ERR(nf))
> > + if (IS_ERR(nf)) {
> > + rcu_read_unlock();
> > goto insert_err;
> > + }
> > nf = nfsd_file_get(nf);
> > + rcu_read_unlock();
>
> Ugh.
> Could we make this:
> rcu_read_lock()
> nf = r_l_g_i_k()
> if (!IS_ERR_OR_NULL(nf))
> nf = nfsd_file_get(nf);
> rcu_read_unlock()
> ...
> ??
>
> NeilBrown
>
Good point. I'll resend a v2 here.
> > if (nf == NULL) {
> > nf = new;
> > goto open_file;
> > --
> > 2.37.3
> >
> >
--
Jeff Layton <jlayton@xxxxxxxxxx>
