From: "J. Bruce Fields" <bfields@redhat.com>
To: linux-nfs@vger.kernel.org
Cc: "J. Bruce Fields" <bfields@redhat.com>
Subject: [PATCH 0/2] nfsd shoudn't call mnt_want_write twice
Date: Mon, 13 May 2019 11:27:01 -0400 [thread overview]
Message-ID: <1557761223-14483-1-git-send-email-bfields@redhat.com> (raw)
From: "J. Bruce Fields" <bfields@redhat.com>
A fuzzer recently triggered lockdep warnings about potential sb_writers
deadlocks caused by fh_want_write, showing that we haven't been careful
to pair each fh_want_write() with an fh_drop_write().
This isn't normally a problem since fh_put() will call fh_drop_write()
for us. And that's OK for NFSv3. But an NFSv4 protocol fuzzer can do
weird things like call unlink twice in a compound.
So we can either make it safe to call fh_want_write() twice, or we can
fix all the callers to call fh_drop_write().
For now I think we have to do the former just to get the bug fixed.
Long term I don't know whether it's best to stay with that or to fix up
the callers. I fixed nfsd_unlink just because it's easy, but maybe
that's pointless, it's others (like setattr) that are the complicated
ones.
J. Bruce Fields (2):
nfsd: allow fh_want_write to be called twice
nfsd: fh_drop_write in nfsd_unlink
fs/nfsd/vfs.c | 8 +++++---
fs/nfsd/vfs.h | 5 ++++-
2 files changed, 9 insertions(+), 4 deletions(-)
--
2.21.0
next reply other threads:[~2019-05-13 15:27 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-13 15:27 J. Bruce Fields [this message]
2019-05-13 15:27 ` [PATCH 1/2] nfsd: allow fh_want_write to be called twice J. Bruce Fields
2019-05-13 15:27 ` [PATCH 2/2] nfsd: fh_drop_write in nfsd_unlink J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1557761223-14483-1-git-send-email-bfields@redhat.com \
--to=bfields@redhat.com \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.