| Message ID | 20240103-nfsd-fixes-v1-1-4f4f9d7edd0d@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | nfsd: drop the nfsd_put helper | expand |
On Wed, Jan 03, 2024 at 08:36:52AM -0500, Jeff Layton wrote: > It's not safe to call nfsd_put once nfsd_last_thread has been called, as > that function will zero out the nn->nfsd_serv pointer. > > Drop the nfsd_put helper altogether and open-code the svc_put in its > callers instead. That allows us to not be reliant on the value of that > pointer when handling an error. > > Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()") > Reported-by: Zhi Li <yieli@redhat.com> > Cc: NeilBrown <neilb@suse.de> > Signed-off-by: Jeffrey Layton <jlayton@redhat.com> > --- > I know it's late, but it would be good to get this into v6.7 if > possible. I think it's fairly straightforward. How is Zhi finding these? Are there administrative API tests that can be shared with the community (say, by adding them to kdevops)? > --- > fs/nfsd/nfsctl.c | 31 +++++++++++++++++-------------- > fs/nfsd/nfsd.h | 7 ------- > 2 files changed, 17 insertions(+), 21 deletions(-) > > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > index 7cd513e59305..87fed75808ff 100644 > --- a/fs/nfsd/nfsctl.c > +++ b/fs/nfsd/nfsctl.c > @@ -693,6 +693,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred > char *mesg = buf; > int fd, err; > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > + struct svc_serv *serv; > > err = get_int(&mesg, &fd); > if (err != 0 || fd < 0) > @@ -703,15 +704,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred > if (err != 0) > return err; > > - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); > + serv = nn->nfsd_serv; > + err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); > > - if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) > + if (err < 0 && !serv->sv_nrthreads && !nn->keep_active) > nfsd_last_thread(net); > - else if (err >= 0 && > - !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > - svc_get(nn->nfsd_serv); > + else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > + svc_get(serv); > > - nfsd_put(net); > + svc_put(serv); > return err; > } > > @@ -725,6 +726,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr > struct svc_xprt *xprt; > int port, err; > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > + struct svc_serv *serv; > > if (sscanf(buf, "%15s %5u", transport, &port) != 2) > return -EINVAL; > @@ -737,32 +739,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr > if (err != 0) > return err; > > - err = svc_xprt_create(nn->nfsd_serv, transport, net, > + serv = nn->nfsd_serv; > + err = svc_xprt_create(serv, transport, net, > PF_INET, port, SVC_SOCK_ANONYMOUS, cred); > if (err < 0) > goto out_err; > > - err = svc_xprt_create(nn->nfsd_serv, transport, net, > + err = svc_xprt_create(serv, transport, net, > PF_INET6, port, SVC_SOCK_ANONYMOUS, cred); > if (err < 0 && err != -EAFNOSUPPORT) > goto out_close; > > - if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > - svc_get(nn->nfsd_serv); > + if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > + svc_get(serv); > > - nfsd_put(net); > + svc_put(serv); > return 0; > out_close: > - xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port); > + xprt = svc_find_xprt(serv, transport, net, PF_INET, port); > if (xprt != NULL) { > svc_xprt_close(xprt); > svc_xprt_put(xprt); > } > out_err: > - if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) > + if (!serv->sv_nrthreads && !nn->keep_active) > nfsd_last_thread(net); > > - nfsd_put(net); > + svc_put(serv); > return err; > } > > diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h > index 3286ffacbc56..9ed0e08d16c2 100644 > --- a/fs/nfsd/nfsd.h > +++ b/fs/nfsd/nfsd.h > @@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file *); > int nfsd_pool_stats_release(struct inode *, struct file *); > void nfsd_shutdown_threads(struct net *net); > > -static inline void nfsd_put(struct net *net) > -{ > - struct nfsd_net *nn = net_generic(net, nfsd_net_id); > - > - svc_put(nn->nfsd_serv); > -} > - > bool i_am_nfsd(void); > > struct nfsdfs_client { > > --- > base-commit: 610a9b8f49fbcf1100716370d3b5f6f884a2835a > change-id: 20240103-nfsd-fixes-1f1196134a11 > > Best regards, > -- > Jeff Layton <jlayton@kernel.org> >
On Wed, 2024-01-03 at 09:48 -0500, Chuck Lever wrote: > On Wed, Jan 03, 2024 at 08:36:52AM -0500, Jeff Layton wrote: > > It's not safe to call nfsd_put once nfsd_last_thread has been called, as > > that function will zero out the nn->nfsd_serv pointer. > > > > Drop the nfsd_put helper altogether and open-code the svc_put in its > > callers instead. That allows us to not be reliant on the value of that > > pointer when handling an error. > > > > Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()") > > Reported-by: Zhi Li <yieli@redhat.com> > > Cc: NeilBrown <neilb@suse.de> > > Signed-off-by: Jeffrey Layton <jlayton@redhat.com> > > --- > > I know it's late, but it would be good to get this into v6.7 if > > possible. I think it's fairly straightforward. > > How is Zhi finding these? Are there administrative API tests that > can be shared with the community (say, by adding them to kdevops)? > > I wish I knew. In most of these, we see these messages ahead of the KASAN pops that he's reporting: [ 643.617739] NFSD: Using UMH upcall client tracking operations. [ 643.617755] NFSD: starting 90-second grace period (net f0000000) [ 643.780487] svc: failed to register nfsdv3 RPC service (errno 512). [ 643.780928] svc: failed to register nfsaclv3 RPC service (errno 512). [ 643.794625] ================================================================== [ 643.794635] BUG: KASAN: null-ptr-deref in __write_ports_addfd+0x3b9/0x6c0 [nfsd] [ 643.794779] Write of size 4 at addr 0000000000000058 by task rpc.nfsd/16702 [ 643.794783] ... The errno 512 makes me suspect that the rpcbind registration attempt is catching a signal, and that failure then bubbles up when we're trying to start the server. I've not been able to reproduce this myself though. > > --- > > fs/nfsd/nfsctl.c | 31 +++++++++++++++++-------------- > > fs/nfsd/nfsd.h | 7 ------- > > 2 files changed, 17 insertions(+), 21 deletions(-) > > > > diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c > > index 7cd513e59305..87fed75808ff 100644 > > --- a/fs/nfsd/nfsctl.c > > +++ b/fs/nfsd/nfsctl.c > > @@ -693,6 +693,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred > > char *mesg = buf; > > int fd, err; > > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > + struct svc_serv *serv; > > > > err = get_int(&mesg, &fd); > > if (err != 0 || fd < 0) > > @@ -703,15 +704,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred > > if (err != 0) > > return err; > > > > - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); > > + serv = nn->nfsd_serv; > > + err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); > > > > - if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) > > + if (err < 0 && !serv->sv_nrthreads && !nn->keep_active) > > nfsd_last_thread(net); > > - else if (err >= 0 && > > - !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > > - svc_get(nn->nfsd_serv); > > + else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > > + svc_get(serv); > > > > - nfsd_put(net); > > + svc_put(serv); > > return err; > > } > > > > @@ -725,6 +726,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr > > struct svc_xprt *xprt; > > int port, err; > > struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > + struct svc_serv *serv; > > > > if (sscanf(buf, "%15s %5u", transport, &port) != 2) > > return -EINVAL; > > @@ -737,32 +739,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr > > if (err != 0) > > return err; > > > > - err = svc_xprt_create(nn->nfsd_serv, transport, net, > > + serv = nn->nfsd_serv; > > + err = svc_xprt_create(serv, transport, net, > > PF_INET, port, SVC_SOCK_ANONYMOUS, cred); > > if (err < 0) > > goto out_err; > > > > - err = svc_xprt_create(nn->nfsd_serv, transport, net, > > + err = svc_xprt_create(serv, transport, net, > > PF_INET6, port, SVC_SOCK_ANONYMOUS, cred); > > if (err < 0 && err != -EAFNOSUPPORT) > > goto out_close; > > > > - if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > > - svc_get(nn->nfsd_serv); > > + if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) > > + svc_get(serv); > > > > - nfsd_put(net); > > + svc_put(serv); > > return 0; > > out_close: > > - xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port); > > + xprt = svc_find_xprt(serv, transport, net, PF_INET, port); > > if (xprt != NULL) { > > svc_xprt_close(xprt); > > svc_xprt_put(xprt); > > } > > out_err: > > - if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) > > + if (!serv->sv_nrthreads && !nn->keep_active) > > nfsd_last_thread(net); > > > > - nfsd_put(net); > > + svc_put(serv); > > return err; > > } > > > > diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h > > index 3286ffacbc56..9ed0e08d16c2 100644 > > --- a/fs/nfsd/nfsd.h > > +++ b/fs/nfsd/nfsd.h > > @@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file *); > > int nfsd_pool_stats_release(struct inode *, struct file *); > > void nfsd_shutdown_threads(struct net *net); > > > > -static inline void nfsd_put(struct net *net) > > -{ > > - struct nfsd_net *nn = net_generic(net, nfsd_net_id); > > - > > - svc_put(nn->nfsd_serv); > > -} > > - > > bool i_am_nfsd(void); > > > > struct nfsdfs_client { > > > > --- > > base-commit: 610a9b8f49fbcf1100716370d3b5f6f884a2835a > > change-id: 20240103-nfsd-fixes-1f1196134a11 > > > > Best regards, > > -- > > Jeff Layton <jlayton@kernel.org> > > >
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 7cd513e59305..87fed75808ff 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -693,6 +693,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred char *mesg = buf; int fd, err; struct nfsd_net *nn = net_generic(net, nfsd_net_id); + struct svc_serv *serv; err = get_int(&mesg, &fd); if (err != 0 || fd < 0) @@ -703,15 +704,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred if (err != 0) return err; - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); + serv = nn->nfsd_serv; + err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); - if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) + if (err < 0 && !serv->sv_nrthreads && !nn->keep_active) nfsd_last_thread(net); - else if (err >= 0 && - !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) - svc_get(nn->nfsd_serv); + else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) + svc_get(serv); - nfsd_put(net); + svc_put(serv); return err; } @@ -725,6 +726,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr struct svc_xprt *xprt; int port, err; struct nfsd_net *nn = net_generic(net, nfsd_net_id); + struct svc_serv *serv; if (sscanf(buf, "%15s %5u", transport, &port) != 2) return -EINVAL; @@ -737,32 +739,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr if (err != 0) return err; - err = svc_xprt_create(nn->nfsd_serv, transport, net, + serv = nn->nfsd_serv; + err = svc_xprt_create(serv, transport, net, PF_INET, port, SVC_SOCK_ANONYMOUS, cred); if (err < 0) goto out_err; - err = svc_xprt_create(nn->nfsd_serv, transport, net, + err = svc_xprt_create(serv, transport, net, PF_INET6, port, SVC_SOCK_ANONYMOUS, cred); if (err < 0 && err != -EAFNOSUPPORT) goto out_close; - if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) - svc_get(nn->nfsd_serv); + if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) + svc_get(serv); - nfsd_put(net); + svc_put(serv); return 0; out_close: - xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port); + xprt = svc_find_xprt(serv, transport, net, PF_INET, port); if (xprt != NULL) { svc_xprt_close(xprt); svc_xprt_put(xprt); } out_err: - if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) + if (!serv->sv_nrthreads && !nn->keep_active) nfsd_last_thread(net); - nfsd_put(net); + svc_put(serv); return err; } diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h index 3286ffacbc56..9ed0e08d16c2 100644 --- a/fs/nfsd/nfsd.h +++ b/fs/nfsd/nfsd.h @@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file *); int nfsd_pool_stats_release(struct inode *, struct file *); void nfsd_shutdown_threads(struct net *net); -static inline void nfsd_put(struct net *net) -{ - struct nfsd_net *nn = net_generic(net, nfsd_net_id); - - svc_put(nn->nfsd_serv); -} - bool i_am_nfsd(void); struct nfsdfs_client {
It's not safe to call nfsd_put once nfsd_last_thread has been called, as that function will zero out the nn->nfsd_serv pointer. Drop the nfsd_put helper altogether and open-code the svc_put in its callers instead. That allows us to not be reliant on the value of that pointer when handling an error. Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()") Reported-by: Zhi Li <yieli@redhat.com> Cc: NeilBrown <neilb@suse.de> Signed-off-by: Jeffrey Layton <jlayton@redhat.com> --- I know it's late, but it would be good to get this into v6.7 if possible. I think it's fairly straightforward. --- fs/nfsd/nfsctl.c | 31 +++++++++++++++++-------------- fs/nfsd/nfsd.h | 7 ------- 2 files changed, 17 insertions(+), 21 deletions(-) --- base-commit: 610a9b8f49fbcf1100716370d3b5f6f884a2835a change-id: 20240103-nfsd-fixes-1f1196134a11 Best regards,