Skip to content

Commit f89ea63

Browse files
dhowellsbrauner
authored andcommitted
netfs, 9p: Fix race between umount and async request completion
There's a problem in 9p's interaction with netfslib whereby a crash occurs because the 9p_fid structs get forcibly destroyed during client teardown (without paying attention to their refcounts) before netfslib has finished with them. However, it's not a simple case of deferring the clunking that p9_fid_put() does as that requires the p9_client record to still be present. The problem is that netfslib has to unlock pages and clear the IN_PROGRESS flag before destroying the objects involved - including the fid - and, in any case, nothing checks to see if writeback completed barring looking at the page flags. Fix this by keeping a count of outstanding I/O requests (of any type) and waiting for it to quiesce during inode eviction. Reported-by: syzbot+df038d463cca332e8414@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/0000000000005be0aa061846f8d6@google.com/ Reported-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000b86c5e06130da9c6@google.com/ Reported-by: syzbot+1527696d41a634cc1819@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000041f960618206d7e@google.com/ Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/755891.1716560771@warthog.procyon.org.uk Tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Reviewed-by: Dominique Martinet <asmadeus@codewreck.org> cc: Eric Van Hensbergen <ericvh@kernel.org> cc: Latchesar Ionkov <lucho@ionkov.net> cc: Christian Schoenebeck <linux_oss@crudebyte.com> cc: Jeff Layton <jlayton@kernel.org> cc: Steve French <sfrench@samba.org> cc: Hillf Danton <hdanton@sina.com> cc: v9fs@lists.linux.dev cc: linux-afs@lists.infradead.org cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Reported-and-tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Signed-off-by: Christian Brauner <brauner@kernel.org>
1 parent 29be910 commit f89ea63

File tree

5 files changed

+26
-0
lines changed

5 files changed

+26
-0
lines changed

fs/9p/vfs_inode.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,7 @@ void v9fs_evict_inode(struct inode *inode)
348348
__le32 __maybe_unused version;
349349

350350
if (!is_bad_inode(inode)) {
351+
netfs_wait_for_outstanding_io(inode);
351352
truncate_inode_pages_final(&inode->i_data);
352353

353354
version = cpu_to_le32(v9inode->qid.version);

fs/afs/inode.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,6 +648,7 @@ void afs_evict_inode(struct inode *inode)
648648

649649
ASSERTCMP(inode->i_ino, ==, vnode->fid.vnode);
650650

651+
netfs_wait_for_outstanding_io(inode);
651652
truncate_inode_pages_final(&inode->i_data);
652653

653654
afs_set_cache_aux(vnode, &aux);

fs/netfs/objects.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
7272
}
7373
}
7474

75+
atomic_inc(&ctx->io_count);
7576
trace_netfs_rreq_ref(rreq->debug_id, 1, netfs_rreq_trace_new);
7677
netfs_proc_add_rreq(rreq);
7778
netfs_stat(&netfs_n_rh_rreq);
@@ -124,6 +125,7 @@ static void netfs_free_request(struct work_struct *work)
124125
{
125126
struct netfs_io_request *rreq =
126127
container_of(work, struct netfs_io_request, work);
128+
struct netfs_inode *ictx = netfs_inode(rreq->inode);
127129
unsigned int i;
128130

129131
trace_netfs_rreq(rreq, netfs_rreq_trace_free);
@@ -142,6 +144,9 @@ static void netfs_free_request(struct work_struct *work)
142144
}
143145
kvfree(rreq->direct_bv);
144146
}
147+
148+
if (atomic_dec_and_test(&ictx->io_count))
149+
wake_up_var(&ictx->io_count);
145150
call_rcu(&rreq->rcu, netfs_free_request_rcu);
146151
}
147152

fs/smb/client/cifsfs.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,7 @@ cifs_free_inode(struct inode *inode)
431431
static void
432432
cifs_evict_inode(struct inode *inode)
433433
{
434+
netfs_wait_for_outstanding_io(inode);
434435
truncate_inode_pages_final(&inode->i_data);
435436
if (inode->i_state & I_PINNING_NETFS_WB)
436437
cifs_fscache_unuse_inode_cookie(inode, true);

include/linux/netfs.h

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ struct netfs_inode {
6868
loff_t remote_i_size; /* Size of the remote file */
6969
loff_t zero_point; /* Size after which we assume there's no data
7070
* on the server */
71+
atomic_t io_count; /* Number of outstanding reqs */
7172
unsigned long flags;
7273
#define NETFS_ICTX_ODIRECT 0 /* The file has DIO in progress */
7374
#define NETFS_ICTX_UNBUFFERED 1 /* I/O should not use the pagecache */
@@ -472,6 +473,7 @@ static inline void netfs_inode_init(struct netfs_inode *ctx,
472473
ctx->remote_i_size = i_size_read(&ctx->inode);
473474
ctx->zero_point = LLONG_MAX;
474475
ctx->flags = 0;
476+
atomic_set(&ctx->io_count, 0);
475477
#if IS_ENABLED(CONFIG_FSCACHE)
476478
ctx->cache = NULL;
477479
#endif
@@ -515,4 +517,20 @@ static inline struct fscache_cookie *netfs_i_cookie(struct netfs_inode *ctx)
515517
#endif
516518
}
517519

520+
/**
521+
* netfs_wait_for_outstanding_io - Wait for outstanding I/O to complete
522+
* @ctx: The netfs inode to wait on
523+
*
524+
* Wait for outstanding I/O requests of any type to complete. This is intended
525+
* to be called from inode eviction routines. This makes sure that any
526+
* resources held by those requests are cleaned up before we let the inode get
527+
* cleaned up.
528+
*/
529+
static inline void netfs_wait_for_outstanding_io(struct inode *inode)
530+
{
531+
struct netfs_inode *ictx = netfs_inode(inode);
532+
533+
wait_var_event(&ictx->io_count, atomic_read(&ictx->io_count) == 0);
534+
}
535+
518536
#endif /* _LINUX_NETFS_H */

0 commit comments

Comments
 (0)