fs: nfs: Fix a sleep-in-atomic bug in nfs_access_add_cache
diff mbox

Message ID 1496649904-1855-1-git-send-email-baijiaju1990@163.com
State New
Headers show

Commit Message

Jia-Ju Bai June 5, 2017, 8:05 a.m. UTC
The driver may sleep under a rcu read lock, and function call path is:
nfs_permission (acquire the lock by rcu_read_lock)
  nfs_do_access
    nfs_access_add_cache
      kmalloc(GFP_KERNEL) --> may sleep

To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
---
 fs/nfs/dir.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Trond Myklebust June 5, 2017, 11:48 a.m. UTC | #1
On Mon, 2017-06-05 at 16:05 +0800, Jia-Ju Bai wrote:
> The driver may sleep under a rcu read lock, and function call path

> is:

> nfs_permission (acquire the lock by rcu_read_lock)

>   nfs_do_access

>     nfs_access_add_cache

>       kmalloc(GFP_KERNEL) --> may sleep

> 

> To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".

> 

> Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>

> ---

>  fs/nfs/dir.c |    2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

> 

> diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c

> index 32ccd77..7a074db 100644

> --- a/fs/nfs/dir.c

> +++ b/fs/nfs/dir.c

> @@ -2333,7 +2333,7 @@ static void nfs_access_add_rbtree(struct inode

> *inode, struct nfs_access_entry *

>  

>  void nfs_access_add_cache(struct inode *inode, struct

> nfs_access_entry *set)

>  {

> -	struct nfs_access_entry *cache = kmalloc(sizeof(*cache),

> GFP_KERNEL);

> +	struct nfs_access_entry *cache = kmalloc(sizeof(*cache),

> GFP_ATOMIC);

>  	if (cache == NULL)

>  		return;

>  	RB_CLEAR_NODE(&cache->rb_node);


The RCU locked codepath will not ever hit nfs_access_add_rbtree(). It
returns with an error code of -ECHILD after the test of "may_block".

Cheers
  Trond
-- 
Trond Myklebust
Linux NFS client maintainer, PrimaryData
trond.myklebust@primarydata.com
Jia-Ju Bai June 5, 2017, 12:36 p.m. UTC | #2
On 06/05/2017 07:48 PM, Trond Myklebust wrote:
> On Mon, 2017-06-05 at 16:05 +0800, Jia-Ju Bai wrote:
>> The driver may sleep under a rcu read lock, and function call path
>> is:
>> nfs_permission (acquire the lock by rcu_read_lock)
>>    nfs_do_access
>>      nfs_access_add_cache
>>        kmalloc(GFP_KERNEL) -->  may sleep
>>
>> To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
>>
>> Signed-off-by: Jia-Ju Bai<baijiaju1990@163.com>
>> ---
>>   fs/nfs/dir.c |    2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
>> index 32ccd77..7a074db 100644
>> --- a/fs/nfs/dir.c
>> +++ b/fs/nfs/dir.c
>> @@ -2333,7 +2333,7 @@ static void nfs_access_add_rbtree(struct inode
>> *inode, struct nfs_access_entry *
>>   
>>   void nfs_access_add_cache(struct inode *inode, struct
>> nfs_access_entry *set)
>>   {
>> -	struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
>> GFP_KERNEL);
>> +	struct nfs_access_entry *cache = kmalloc(sizeof(*cache),
>> GFP_ATOMIC);
>>   	if (cache == NULL)
>>   		return;
>>   	RB_CLEAR_NODE(&cache->rb_node);
> The RCU locked codepath will not ever hit nfs_access_add_rbtree(). It
> returns with an error code of -ECHILD after the test of "may_block".
>
> Cheers
>    Trond
Yes, I think you are right.

Thanks,
Jia-Ju Bai

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32ccd77..7a074db 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2333,7 +2333,7 @@  static void nfs_access_add_rbtree(struct inode *inode, struct nfs_access_entry *
 
 void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *set)
 {
-	struct nfs_access_entry *cache = kmalloc(sizeof(*cache), GFP_KERNEL);
+	struct nfs_access_entry *cache = kmalloc(sizeof(*cache), GFP_ATOMIC);
 	if (cache == NULL)
 		return;
 	RB_CLEAR_NODE(&cache->rb_node);