linux/fs/nfs
Jeff Layton db2efec0ca nfs: take extra reference to fl->fl_file when running a LOCKU operation
Jean reported another crash, similar to the one fixed by feaff8e5b2:

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000148
    IP: [<ffffffff8124ef7f>] locks_get_lock_context+0xf/0xa0
    PGD 0
    Oops: 0000 [#1] SMP
    Modules linked in: nfsv3 nfs_layout_flexfiles rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache vmw_vsock_vmci_transport vsock cfg80211 rfkill coretemp crct10dif_pclmul ppdev vmw_balloon crc32_pclmul crc32c_intel ghash_clmulni_intel pcspkr vmxnet3 parport_pc i2c_piix4 microcode serio_raw parport nfsd floppy vmw_vmci acpi_cpufreq auth_rpcgss shpchp nfs_acl lockd grace sunrpc vmwgfx drm_kms_helper ttm drm mptspi scsi_transport_spi mptscsih ata_generic mptbase i2c_core pata_acpi
    CPU: 0 PID: 329 Comm: kworker/0:1H Not tainted 4.1.0-rc7+ #2
    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/30/2013
    Workqueue: rpciod rpc_async_schedule [sunrpc]
    30ec000
    RIP: 0010:[<ffffffff8124ef7f>]  [<ffffffff8124ef7f>] locks_get_lock_context+0xf/0xa0
    RSP: 0018:ffff8802330efc08  EFLAGS: 00010296
    RAX: ffff8802330efc58 RBX: ffff880097187c80 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
    RBP: ffff8802330efc18 R08: ffff88023fc173d8 R09: 3038b7bf00000000
    R10: 00002f1a02000000 R11: 3038b7bf00000000 R12: 0000000000000000
    R13: 0000000000000000 R14: ffff8802337a2300 R15: 0000000000000020
    FS:  0000000000000000(0000) GS:ffff88023fc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000148 CR3: 000000003680f000 CR4: 00000000001407f0
    Stack:
     ffff880097187c80 ffff880097187cd8 ffff8802330efc98 ffffffff81250281
     ffff8802330efc68 ffffffffa013e7df ffff8802330efc98 0000000000000246
     ffff8801f6901c00 ffff880233d2b8d8 ffff8802330efc58 ffff8802330efc58
    Call Trace:
     [<ffffffff81250281>] __posix_lock_file+0x31/0x5e0
     [<ffffffffa013e7df>] ? rpc_wake_up_task_queue_locked.part.35+0xcf/0x240 [sunrpc]
     [<ffffffff8125088b>] posix_lock_file_wait+0x3b/0xd0
     [<ffffffffa03890b2>] ? nfs41_wake_and_assign_slot+0x32/0x40 [nfsv4]
     [<ffffffffa0365808>] ? nfs41_sequence_done+0xd8/0x300 [nfsv4]
     [<ffffffffa0367525>] do_vfs_lock+0x35/0x40 [nfsv4]
     [<ffffffffa03690c1>] nfs4_locku_done+0x81/0x120 [nfsv4]
     [<ffffffffa013e310>] ? rpc_destroy_wait_queue+0x20/0x20 [sunrpc]
     [<ffffffffa013e310>] ? rpc_destroy_wait_queue+0x20/0x20 [sunrpc]
     [<ffffffffa013e33c>] rpc_exit_task+0x2c/0x90 [sunrpc]
     [<ffffffffa0134400>] ? call_refreshresult+0x170/0x170 [sunrpc]
     [<ffffffffa013ece4>] __rpc_execute+0x84/0x410 [sunrpc]
     [<ffffffffa013f085>] rpc_async_schedule+0x15/0x20 [sunrpc]
     [<ffffffff810add67>] process_one_work+0x147/0x400
     [<ffffffff810ae42b>] worker_thread+0x11b/0x460
     [<ffffffff810ae310>] ? rescuer_thread+0x2f0/0x2f0
     [<ffffffff810b35d9>] kthread+0xc9/0xe0
     [<ffffffff81010000>] ? perf_trace_xen_mmu_set_pmd+0xa0/0x160
     [<ffffffff810b3510>] ? kthread_create_on_node+0x170/0x170
     [<ffffffff8173c222>] ret_from_fork+0x42/0x70
     [<ffffffff810b3510>] ? kthread_create_on_node+0x170/0x170
    Code: a5 81 e8 85 75 e4 ff c6 05 31 ee aa 00 01 eb 98 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 54 49 89 fc 53 <48> 8b 9f 48 01 00 00 48 85 db 74 08 48 89 d8 5b 41 5c 5d c3 83
    RIP  [<ffffffff8124ef7f>] locks_get_lock_context+0xf/0xa0
     RSP <ffff8802330efc08>
    CR2: 0000000000000148
    ---[ end trace 64484f16250de7ef ]---

The problem is almost exactly the same as the one fixed by feaff8e5b2.
We must take a reference to the struct file when running the LOCKU
compound to prevent the final fput from running until the operation is
complete.

Reported-by: Jean Spector <jean@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2015-07-01 11:27:27 -04:00
..
blocklayout NFSv4.1/pnfs: Separate out metadata and data consistency for pNFS 2015-03-27 12:39:38 -04:00
filelayout NFSv4.1/pnfs: Separate out metadata and data consistency for pNFS 2015-03-27 12:39:38 -04:00
flexfilelayout pNFS/flexfiles: Fix the reset of struct pgio_header when resending 2015-06-26 15:39:50 -04:00
objlayout NFSv4.1/pnfs: Separate out metadata and data consistency for pNFS 2015-03-27 12:39:38 -04:00
cache_lib.c
cache_lib.h
callback_proc.c NFS: Ensure that we update the sequence id under the slot table lock 2015-06-11 21:15:52 -04:00
callback_xdr.c NFS: Convert use of __constant_htonl to htonl 2015-06-10 18:57:59 -04:00
callback.c nfs: deny backchannel RPCs with an incorrect authflavor instead of dropping them 2015-06-11 14:06:34 -04:00
callback.h
client.c nfs: Fix showing truncated fsid/dev in, /proc/net/nfsfs/volumes 2015-06-16 11:17:37 -04:00
delegation.c Merge branch 'bugfixes' 2015-04-23 15:16:27 -04:00
delegation.h
dir.c NFS client updates for Linux 4.1 2015-04-26 17:33:59 -07:00
direct.c NFS client updates for Linux 4.1 2015-04-26 17:33:59 -07:00
dns_resolve.c
dns_resolve.h
file.c sunrpc: keep a count of swapfiles associated with the rpc_clnt 2015-06-10 18:26:14 -04:00
fscache-index.c
fscache.c
fscache.h
getroot.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
inode.c NFS: report more appropriate block size for directories. 2015-06-02 08:55:27 -04:00
internal.h
iostat.h
Kconfig kernel: conditionally support non-root users, groups and capabilities 2015-04-15 16:35:22 -07:00
Makefile NFS: Rename idmap.c to nfs4idmap.c 2015-04-23 15:16:14 -04:00
mount_clnt.c
namespace.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
netns.h
nfs2super.c
nfs2xdr.c
nfs3_fs.h
nfs3acl.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
nfs3client.c
nfs3proc.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
nfs3super.c
nfs3xdr.c NFS: Fix size of NFSACL SETACL operations 2015-06-02 08:55:28 -04:00
nfs4_fs.h NFSv.2/pnfs Add a LAYOUTSTATS rpc function 2015-06-24 10:17:37 -04:00
nfs4client.c NFS client updates for Linux 4.1 2015-04-26 17:33:59 -07:00
nfs4file.c nfs: verify open flags before allowing open 2015-06-25 19:38:00 -04:00
nfs4getroot.c
nfs4idmap.c NFS: drop unneeded goto 2015-06-02 08:55:28 -04:00
nfs4idmap.h NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4namespace.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
nfs4proc.c nfs: take extra reference to fl->fl_file when running a LOCKU operation 2015-07-01 11:27:27 -04:00
nfs4renewd.c
nfs4session.c
nfs4session.h NFSv4.1: Clear the old state by our client id before establishing a new lease 2015-03-03 21:52:30 -05:00
nfs4state.c NFSv4: Always drain the slot table before re-establishing the lease 2015-06-02 08:55:27 -04:00
nfs4super.c NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4sysctl.c NFS: Move nfs_idmap.h into fs/nfs/ 2015-04-23 15:16:14 -04:00
nfs4trace.c
nfs4trace.h VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
nfs4xdr.c NFSv.2/pnfs Add a LAYOUTSTATS rpc function 2015-06-24 10:17:37 -04:00
nfs42.h NFSv.2/pnfs Add a LAYOUTSTATS rpc function 2015-06-24 10:17:37 -04:00
nfs42proc.c NFSv4.2: LAYOUTSTATS is optional to implement 2015-06-27 11:48:58 -04:00
nfs42xdr.c NFSv4.2: Fix up a decoding error in layoutstats 2015-06-27 11:30:57 -04:00
nfs.h
nfsroot.c
nfstrace.c NFSv4: Allow tracing of NFSv4 fsync calls 2015-03-27 12:39:34 -04:00
nfstrace.h
pagelist.c nfs: Fix comment for nfs_pageio_init() and nfs_pageio_complete_mirror() 2015-06-18 08:59:13 -04:00
pnfs_dev.c NFSv4.1: Don't cache deviceids that have no notifications 2015-03-27 12:32:24 -04:00
pnfs_nfs.c Merge branch 'bugfixes' 2015-04-23 15:16:27 -04:00
pnfs.c NFSv4.2: LAYOUTSTATS is optional to implement 2015-06-27 11:48:58 -04:00
pnfs.h nfs: provide pnfs_report_layoutstat when NFS42 is disabled 2015-06-26 14:01:37 -04:00
proc.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
read.c NFS client updates for Linux 4.1 2015-04-26 17:33:59 -07:00
super.c NFS client updates for Linux 4.1 2015-04-26 17:33:59 -07:00
symlink.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
sysctl.c
unlink.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
write.c Merge branch 'bugfixes' 2015-06-22 09:55:08 -04:00