Re: [RFC-PATCH] nfsd: when unhashing openowners, increment openowner's refcount

From: "J. Bruce Fields" <bfields@fieldses.org>
To: Alex Lyakas <alex@zadara.com>
Cc: chuck.lever@oracle.com, linux-nfs@vger.kernel.org,
	Shyam Kaushik <shyam@zadara.com>
Subject: Re: [RFC-PATCH] nfsd: when unhashing openowners, increment openowner's refcount
Date: Mon, 26 Aug 2019 09:39:51 -0400	[thread overview]
Message-ID: <20190826133951.GC22759@fieldses.org> (raw)
In-Reply-To: <CAOcd+r0bXefi79dnwrwsDN1OecScfTjc8DYS5_9A8D5XKrh7QQ@mail.gmail.com>

On Sun, Aug 25, 2019 at 01:12:34PM +0300, Alex Lyakas wrote:
> You are listed as maintainers of nfsd. Can you please take a look at
> the below patch?

Thanks!

I take it this was found by some kind of code analysis or fuzzing, not
use in production?

Asking because I've been considering just deprecating it, so:

> > After we fixed this, we confirmed that the openowner is not freed
> > prematurely. It is freed by release_openowner() final call
> > to nfs4_put_stateowner().
> >
> > However, we still get (other) random crashes and memory corruptions
> > when nfsd_inject_forget_client_openowners() and
> > nfsd_inject_forget_openowners().
> > According to our analysis, we don't see any other refcount issues.
> > Can anybody from the community review these flows for other potentials issues?

I'm wondering how much effort we want to put into tracking all that
down.

--b.