From: Josef Bacik <jbacik@fb.com> To: Linus Torvalds <torvalds@linux-foundation.org> Cc: kernel test robot <xiaolong.ye@intel.com>, Al Viro <viro@zeniv.linux.org.uk>, Chris Mason <clm@fb.com>, David Sterba <dsterba@suse.com>, "J. Bruce Fields" <bfields@redhat.com>, LKML <linux-kernel@vger.kernel.org>, LKP <lkp@01.org>, linux-btrfs <linux-btrfs@vger.kernel.org>, Linux NFS Mailing List <linux-nfs@vger.kernel.org> Subject: Re: [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda] Date: Wed, 10 Aug 2016 14:46:27 -0400 [thread overview] Message-ID: <e6fb50d4-2a27-13cd-02c8-5b8439a16b3f@fb.com> (raw) In-Reply-To: <CA+55aFzdTMBc7f5=bQLRUtceu-Kg-MGmzWrAv1r96_ra8yutJA@mail.gmail.com> On 08/10/2016 02:25 PM, Linus Torvalds wrote: > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik <jbacik@fb.com> wrote: >> On 08/10/2016 02:06 PM, Linus Torvalds wrote: >>> >>> More information in the original email on lkml. >> >> I'm not subscribed to lkml and for some reason I can't find the original >> email in any of the lkml/linux-nfs archives. Could you forward more of the >> details? > > Done. > So my naive fix would be something like this From: Josef Bacik <jbacik@fb.com> Date: Wed, 10 Aug 2016 14:43:08 -0400 Subject: [PATCH] nfsd: fix dentry refcounting problem b44061d0b9 introduced a dentry ref counting bug, previously we were grabbing one ref to dchild in nfsd_create(), but with the creation of nfsd_create_locked() we have a ref for dchild from the lookup in nfsd_create(), and then another ref in nfsd_create_locked(). The ref from the lookup in nfsd_create() is never dropped and results in dentries still in use at unmount. Signed-off-by: Josef Bacik <jbacik@fb.com> --- fs/nfsd/vfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index ba944123..ff476e6 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (IS_ERR(dchild)) return nfserrno(host_err); err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); - if (err) { - dput(dchild); + /* + * We unconditionally drop our ref to dchild as fh_compose will have + * already grabbed its own ref for it. + */ + dput(dchild); + if (err) return err; - } return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type, rdev, resfhp); } -- 2.5.5
WARNING: multiple messages have this Message-ID (diff)
From: Josef Bacik <jbacik@fb.com> To: lkp@lists.01.org Subject: Re: [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} still in use (1) [unmount of btrfs vda] Date: Wed, 10 Aug 2016 14:46:27 -0400 [thread overview] Message-ID: <e6fb50d4-2a27-13cd-02c8-5b8439a16b3f@fb.com> (raw) In-Reply-To: <CA+55aFzdTMBc7f5=bQLRUtceu-Kg-MGmzWrAv1r96_ra8yutJA@mail.gmail.com> [-- Attachment #1: Type: text/plain, Size: 1743 bytes --] On 08/10/2016 02:25 PM, Linus Torvalds wrote: > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik <jbacik@fb.com> wrote: >> On 08/10/2016 02:06 PM, Linus Torvalds wrote: >>> >>> More information in the original email on lkml. >> >> I'm not subscribed to lkml and for some reason I can't find the original >> email in any of the lkml/linux-nfs archives. Could you forward more of the >> details? > > Done. > So my naive fix would be something like this From: Josef Bacik <jbacik@fb.com> Date: Wed, 10 Aug 2016 14:43:08 -0400 Subject: [PATCH] nfsd: fix dentry refcounting problem b44061d0b9 introduced a dentry ref counting bug, previously we were grabbing one ref to dchild in nfsd_create(), but with the creation of nfsd_create_locked() we have a ref for dchild from the lookup in nfsd_create(), and then another ref in nfsd_create_locked(). The ref from the lookup in nfsd_create() is never dropped and results in dentries still in use at unmount. Signed-off-by: Josef Bacik <jbacik@fb.com> --- fs/nfsd/vfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index ba944123..ff476e6 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (IS_ERR(dchild)) return nfserrno(host_err); err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); - if (err) { - dput(dchild); + /* + * We unconditionally drop our ref to dchild as fh_compose will have + * already grabbed its own ref for it. + */ + dput(dchild); + if (err) return err; - } return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type, rdev, resfhp); } -- 2.5.5
next prev parent reply other threads:[~2016-08-10 18:48 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-08-10 5:39 [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda] kernel test robot 2016-08-10 5:39 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " kernel test robot 2016-08-10 18:06 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Linus Torvalds 2016-08-10 18:06 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Linus Torvalds 2016-08-10 18:22 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Josef Bacik 2016-08-10 18:22 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Josef Bacik 2016-08-10 18:25 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Linus Torvalds 2016-08-10 18:25 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Linus Torvalds 2016-08-10 18:32 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Josef Bacik 2016-08-10 18:32 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Josef Bacik 2016-08-10 18:46 ` Josef Bacik [this message] 2016-08-10 18:46 ` Josef Bacik 2016-08-10 18:56 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Linus Torvalds 2016-08-10 18:56 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Linus Torvalds 2016-08-10 19:09 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " J. Bruce Fields 2016-08-10 19:09 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " J. Bruce Fields 2016-08-10 19:15 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Linus Torvalds 2016-08-10 19:15 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Linus Torvalds 2016-08-10 19:06 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Jeff Layton 2016-08-10 19:06 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Jeff Layton 2016-08-11 2:19 ` [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} " Al Viro 2016-08-11 2:19 ` [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f, n=0a} " Al Viro
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=e6fb50d4-2a27-13cd-02c8-5b8439a16b3f@fb.com \ --to=jbacik@fb.com \ --cc=bfields@redhat.com \ --cc=clm@fb.com \ --cc=dsterba@suse.com \ --cc=linux-btrfs@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-nfs@vger.kernel.org \ --cc=lkp@01.org \ --cc=torvalds@linux-foundation.org \ --cc=viro@zeniv.linux.org.uk \ --cc=xiaolong.ye@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.