linux/fs/afs
David Howells f89ea63f1c
netfs, 9p: Fix race between umount and async request completion
There's a problem in 9p's interaction with netfslib whereby a crash occurs
because the 9p_fid structs get forcibly destroyed during client teardown
(without paying attention to their refcounts) before netfslib has finished
with them.  However, it's not a simple case of deferring the clunking that
p9_fid_put() does as that requires the p9_client record to still be
present.

The problem is that netfslib has to unlock pages and clear the IN_PROGRESS
flag before destroying the objects involved - including the fid - and, in
any case, nothing checks to see if writeback completed barring looking at
the page flags.

Fix this by keeping a count of outstanding I/O requests (of any type) and
waiting for it to quiesce during inode eviction.

Reported-by: syzbot+df038d463cca332e8414@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/0000000000005be0aa061846f8d6@google.com/
Reported-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000b86c5e06130da9c6@google.com/
Reported-by: syzbot+1527696d41a634cc1819@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000041f960618206d7e@google.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/755891.1716560771@warthog.procyon.org.uk
Tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Reviewed-by: Dominique Martinet <asmadeus@codewreck.org>
cc: Eric Van Hensbergen <ericvh@kernel.org>
cc: Latchesar Ionkov <lucho@ionkov.net>
cc: Christian Schoenebeck <linux_oss@crudebyte.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: Steve French <sfrench@samba.org>
cc: Hillf Danton <hdanton@sina.com>
cc: v9fs@lists.linux.dev
cc: linux-afs@lists.infradead.org
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Reported-and-tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2024-05-27 13:12:13 +02:00
..
addr_list.c afs: Remove the unimplemented afs_cmp_addr_list() 2024-01-01 16:37:26 +00:00
addr_prefs.c afs: Mark address lists with configured priorities 2024-01-01 16:37:27 +00:00
afs_cm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
afs_fs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
afs_vl.h afs: Implement client support for the YFSVL.GetCellName RPC op 2020-06-04 15:37:57 +01:00
afs.h afs: Parse the VolSync record in the reply of a number of RPC ops 2024-01-01 16:37:27 +00:00
callback.c afs: Overhaul invalidation handling to better support RO volumes 2024-01-01 16:37:27 +00:00
cell.c afs: Overhaul invalidation handling to better support RO volumes 2024-01-01 16:37:27 +00:00
cmservice.c rxrpc, afs: Allow afs to pin rxrpc_peer objects 2023-12-24 15:22:50 +00:00
dir_edit.c afs: fix the afs_dir_get_folio return value 2023-05-06 10:10:08 -07:00
dir_silly.c afs: Simplify error handling 2023-12-24 15:22:53 +00:00
dir.c afs: Revert "afs: Hide silly-rename files from userspace" 2024-03-14 11:51:08 +01:00
dynroot.c afs: Remove afs_dynroot_d_revalidate() as it is redundant 2024-01-22 22:30:14 +00:00
file.c netfs, afs: Use writeback retry to deal with alternate keys 2024-05-01 18:07:38 +01:00
flock.c afs: adapt to breakup of struct file_lock 2024-02-05 13:11:42 +01:00
fs_operation.c afs: Fix fileserver rotation 2024-01-01 16:37:27 +00:00
fs_probe.c afs: Fix fileserver rotation 2024-01-01 16:37:27 +00:00
fsclient.c afs: trace: Log afs_make_call(), including server address 2024-01-01 16:37:27 +00:00
inode.c netfs, 9p: Fix race between umount and async request completion 2024-05-27 13:12:13 +02:00
internal.h netfs, afs: Use writeback retry to deal with alternate keys 2024-05-01 18:07:38 +01:00
Kconfig afs: Convert afs to use the new fscache API 2022-01-07 13:44:47 +00:00
main.c afs: Fix ignored callbacks over ipv4 2024-02-20 09:51:21 +01:00
Makefile afs: Move the vnode/volume validity checking code into its own file 2024-01-01 16:37:27 +00:00
misc.c afs: Simplify error handling 2023-12-24 15:22:53 +00:00
mntpt.c afs: Don't cross .backup mountpoint from backup volume 2024-05-25 14:02:40 +02:00
proc.c afs: Fix missing/incorrect unlocking of RCU read lock 2024-01-22 22:30:38 +00:00
protocol_afs.h afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server 2021-09-13 09:14:21 +01:00
protocol_uae.h afs: Add support for the UAE error table 2019-06-28 18:37:53 +01:00
protocol_yfs.h afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server 2021-09-13 09:14:21 +01:00
rotate.c afs: Fix fileserver rotation getting stuck 2024-05-10 08:49:17 +02:00
rxrpc.c afs: trace: Log afs_make_call(), including server address 2024-01-01 16:37:27 +00:00
security.c fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
server_list.c afs: Fix fileserver rotation 2024-01-01 16:37:27 +00:00
server.c afs: Fix ignored callbacks over ipv4 2024-02-20 09:51:21 +01:00
super.c vfs-6.8.netfs 2024-01-19 09:10:23 -08:00
validation.c afs: Use alternative invalidation to using launder_folio 2024-05-01 18:07:34 +01:00
vl_alias.c afs: Defer volume record destruction to a workqueue 2024-01-01 16:37:27 +00:00
vl_list.c afs: Dispatch vlserver probes in priority order 2024-01-01 16:37:27 +00:00
vl_probe.c afs: Keep a record of the current fileserver endpoint state 2024-01-01 16:37:27 +00:00
vl_rotate.c afs: Add some more info to /proc/net/afs/servers 2024-01-01 16:36:58 +00:00
vlclient.c afs: Don't leave DONTUSE/NEWREPSITE servers out of server list 2024-01-01 16:37:27 +00:00
volume.c afs: Increase buffer size in afs_update_volume_status() 2024-02-20 09:51:21 +01:00
write.c netfs, afs: Use writeback retry to deal with alternate keys 2024-05-01 18:07:38 +01:00
xattr.c afs: Add __counted_by for struct afs_acl and use struct_size() 2023-12-01 09:51:43 -08:00
xdr_fs.h afs: Fix directory entry size calculation 2021-01-04 12:25:19 +00:00
yfsclient.c afs: trace: Log afs_make_call(), including server address 2024-01-01 16:37:27 +00:00