| Message ID | 20241216142156.4133267-1-yangerkun@huaweicloud.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | nfsd/sunrpc: cleanup resource with sync mode | expand |
From: Chuck Lever <chuck.lever@oracle.com> On Mon, 16 Dec 2024 22:21:51 +0800, Yang Erkun wrote: > After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with > rcu_work"), svc_export_put/expkey_put will call path_put with async > mode. This can lead some unexpected failure: > > mkdir /mnt/sda > mkfs.xfs -f /dev/sda > echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports > echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports > exportfs -ra > service nfs-server start > mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1 > mount /dev/sda /mnt/sda > touch /mnt1/sda/file > exportfs -r > umount /mnt/sda # failed unexcepted > > [...] Applied to nfsd-fixes for v6.13, thanks! [1/5] nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" commit: 69d803c40edeaf94089fbc8751c9b746cdc35044 -- Chuck Lever
From: Yang Erkun <yangerkun@huawei.com> After f8c989a0c89a ("nfsd: release svc_expkey/svc_export with rcu_work"), svc_export_put/expkey_put will call path_put with async mode. This can lead some unexpected failure: mkdir /mnt/sda mkfs.xfs -f /dev/sda echo "/ *(rw,no_root_squash,fsid=0)" > /etc/exports echo "/mnt *(rw,no_root_squash,fsid=1)" >> /etc/exports exportfs -ra service nfs-server start mount -t nfs -o vers=4.0 127.0.0.1:/mnt /mnt1 mount /dev/sda /mnt/sda touch /mnt1/sda/file exportfs -r umount /mnt/sda # failed unexcepted The touch above will finally call nfsd_cross_mnt, add refcount to mount, and then add cache_head. Before this commit, exportfs -r will call cache_flush to cleanup all cache_head, and path_put in svc_export_put/expkey_put will be finished with sync mode. So, the latter umount will always success. However, after this commit, path_put will be called with async mode, the latter umount may failed, and if we add some delay, umount will success too. Personally I think this bug and should be fixed. We first revert before bugfix patch, and then fix the original bug with a different way. Yang Erkun (5): nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" SUNRPC: move cache_put out from cache_check nfsd: no need get cache ref when protected by rcu SUNRPC: no need get cache ref when protected by rcu nfsd: fix UAF when access ex_uuid or ex_stats fs/nfs/dns_resolve.c | 4 +++- fs/nfsd/export.c | 34 ++++++++++--------------------- fs/nfsd/export.h | 4 ++-- fs/nfsd/nfs4idmap.c | 2 ++ net/sunrpc/auth_gss/svcauth_gss.c | 9 ++++++-- net/sunrpc/cache.c | 11 ++-------- net/sunrpc/svcauth_unix.c | 12 ++++++++++- 7 files changed, 38 insertions(+), 38 deletions(-)