linux-kernel - Re: [lkp] [nfsd] b44061d0b9: BUG: Dentry ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160811021909.GR2356@ZenIV.linux.org.uk>
Date:	Thu, 11 Aug 2016 03:19:09 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Josef Bacik <jbacik@...com>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	kernel test robot <xiaolong.ye@...el.com>,
	Chris Mason <clm@...com>, David Sterba <dsterba@...e.com>,
	"J. Bruce Fields" <bfields@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>, LKP <lkp@...org>,
	linux-btrfs <linux-btrfs@...r.kernel.org>,
	Linux NFS Mailing List <linux-nfs@...r.kernel.org>
Subject: Re: [lkp] [nfsd] b44061d0b9: BUG: Dentry
 ffff880027d7c540{i=1846f,n=0a} still in use (1) [unmount of btrfs vda]

On Wed, Aug 10, 2016 at 02:46:27PM -0400, Josef Bacik wrote:
> On 08/10/2016 02:25 PM, Linus Torvalds wrote:
> > On Wed, Aug 10, 2016 at 11:22 AM, Josef Bacik <jbacik@...com> wrote:
> > > On 08/10/2016 02:06 PM, Linus Torvalds wrote:
> > > > 
> > > > More information in the original email on lkml.
> > > 
> > > I'm not subscribed to lkml and for some reason I can't find the original
> > > email in any of the lkml/linux-nfs archives.  Could you forward more of the
> > > details?
> > 
> > Done.
> > 
> 
> So my naive fix would be something like this
> 
> 
> From: Josef Bacik <jbacik@...com>
> Date: Wed, 10 Aug 2016 14:43:08 -0400
> Subject: [PATCH] nfsd: fix dentry refcounting problem
> 
> b44061d0b9 introduced a dentry ref counting bug, previously we were grabbing one
> ref to dchild in nfsd_create(), but with the creation of nfsd_create_locked() we
> have a ref for dchild from the lookup in nfsd_create(), and then another ref in
> nfsd_create_locked().  The ref from the lookup in nfsd_create() is never dropped
> and results in dentries still in use at unmount.
> 
> Signed-off-by: Josef Bacik <jbacik@...com>

[sorry, had been off-line since yesterday]

Patch looks sane; feel free to slap Acked-by: Al Viro <viro@...iv.linux.org.uk>
on it.  I think it should go through nfsd tree.