• J. Bruce Fields's avatar
    nfs: fix NULL deference in nfs4_get_valid_delegation · 29fe8399
    J. Bruce Fields authored
    We add the new state to the nfsi->open_states list, making it
    potentially visible to other threads, before we've finished initializing
    it.
    
    That wasn't a problem when all the readers were also taking the i_lock
    (as we do here), but since we switched to RCU, there's now a possibility
    that a reader could see the partially initialized state.
    
    Symptoms observed were a crash when another thread called
    nfs4_get_valid_delegation() on a NULL inode, resulting in an oops like:
    
    	BUG: unable to handle page fault for address: ffffffffffffffb0 ...
    	RIP: 0010:nfs4_get_valid_delegation+0x6/0x30 [nfsv4] ...
    	Call Trace:
    	 nfs4_open_prepare+0x80/0x1c0 [nfsv4]
    	 __rpc_execute+0x75/0x390 [sunrpc]
    	 ? finish_task_switch+0x75/0x260
    	 rpc_async_schedule+0x29/0x40 [sunrpc]
    	 process_one_work+0x1ad/0x370
    	 worker_thread+0x30/0x390
    	 ? create_worker+0x1a0/0x1a0
    	 kthread+0x10c/0x130
    	 ? kthread_park+0x80/0x80
    	 ret_from_fork+0x22/0x30
    
    Fixes: 9ae075fd "NFSv4: Convert open state lookup to use RCU"
    Reviewed-by: default avatarSeiichi Ikarashi <s.ikarashi@fujitsu.com>
    Tested-by: default avatarDaisuke Matsuda <matsuda-daisuke@fujitsu.com>
    Tested-by: default avatarMasayoshi Mizuma <m.mizuma@jp.fujitsu.com>
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    Cc: stable@vger.kernel.org # v4.20+
    Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
    29fe8399
nfs4state.c 70.5 KB