March 2026 - Devel - NFS Ganesha List Archives

[S] Change in ...nfs-ganesha[next]: close_fsal_fd: remove GLOBAL_FD on close from lru list.
by Name of user not set (GerritHub) 02 Mar '26

02 Mar '26

deeraj.patil(a)ibm.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232498?usp=email ) Change subject: close_fsal_fd: remove GLOBAL_FD on close from lru list. ...................................................................... close_fsal_fd: remove GLOBAL_FD on close from lru list. The previous logic skipped remove_fd_lru when ERR_FSAL_NOT_OPENED was returned (FD already logically closed). When doing release(), which internally calls the close_fsal_fd on FD already in closed state, this FD doesn't get removed from global_lru_list and is freed. This dangling entry is pickedup by the reaper thread causing unintented behaviour (Use-after-free). Change-Id: I14dc304c2126ff991b223c841ffd22a1a7ba953d Signed-off-by: Deeraj.Patil <Deeraj.Patil(a)ibm.com> --- M src/FSAL/commonlib.c 1 file changed, 18 insertions(+), 10 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/98/1232498/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232498?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I14dc304c2126ff991b223c841ffd22a1a7ba953d Gerrit-Change-Number: 1232498 Gerrit-PatchSet: 1 Gerrit-Owner: deeraj.patil(a)ibm.com

1 0

[S] Change in ...nfs-ganesha[next]: [unexport] : NFSv3 stop new IO's when unexport in progress.
by Name of user not set (GerritHub) 02 Mar '26

02 Mar '26

deeraj.patil(a)ibm.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232497?usp=email ) Change subject: [unexport] : NFSv3 stop new IO's when unexport in progress. ...................................................................... [unexport] : NFSv3 stop new IO's when unexport in progress. mdcache_locate_host is called for every NFS request (NFSv3 and NFSv4) that carries a file handle via create_handle. On a cache hit it returns the cached entry without checking whether the current export is being unexported or whether the entry is still mapped to the requesting export. A concurrent NFSv3 request arriving while mdcache_unexport is removing entries can receive a valid-looking entry whose backing export is being freed. The caller then proceeds to reopen_fsal_fd, re-inserting a FD into the global LRU under the dying export's fsal_export pointer, eventually causing a use-after-free in the LRU reaper. After a cache hit, call mdc_check_mapping() to verify the entry is still mapped to the current export and MDC_UNEXPORT is not set. Change-Id: I5b0b0f74a71977dab27045029f38a0f3309af5d4 Signed-off-by: Deeraj.Patil <Deeraj.Patil(a)ibm.com> --- M src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_helpers.c 1 file changed, 24 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/97/1232497/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232497?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I5b0b0f74a71977dab27045029f38a0f3309af5d4 Gerrit-Change-Number: 1232497 Gerrit-PatchSet: 1 Gerrit-Owner: deeraj.patil(a)ibm.com

1 0

[M] Change in ...nfs-ganesha[next]: [mdcache] : Export cleanup, releasing FD's.
by Name of user not set (GerritHub) 02 Mar '26

02 Mar '26

deeraj.patil(a)ibm.com has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232496?usp=email ) Change subject: [mdcache] : Export cleanup, releasing FD's. ...................................................................... [mdcache] : Export cleanup, releasing FD's. When an export is removed (SIGHUP or admin), the call sequence is: prepare_unexport -> state_release_export -> unexport -> exp_release. NFSv3 is stateless: state_release_export closes nothing for NFSv3. Global FDs on mdcache entries (opened by NFSv3 READ/WRITE) survive with fsal_export pointers that are about to be freed. The LRU reaper running concurrently can dereference those pointers after exp_release frees the export struct (use-after-free). In-flight NFSv3 threads that already resolved a file handle can also call reopen_fsal_fd between unexport's fsal_close calls and exp_release, re-inserting a FD into the global LRU for a being-freed export. Nested export case (exportA inside exportB): entries shared between exportA and exportB both needs to drain global FD base on which export is getting released. And is tracked via cleanup_export/cleanup_pending; the export drain waits for all of them before releasing the export struct. Two early-stop flags prevent new FDs from being created on a dying export: EXPORT_STALE is set in release_export before prepare_unexport, and MDC_UNEXPORT is set in mdcache_prepare_unexport itself. During mdcache_unexport, global FDs are force-closed via fsal_close on every entry; entries that become fully unmapped (expmap==NULL) are additionally tracked by setting entry->cleanup_export and incrementing exp->cleanup_pending, while entries still mapped to a sibling export only get their FD closed (no tracking needed, they stay alive). The same tracking applies in mdcache_unmount for junction entries. When the LRU thread finally cleans a tracked entry in mdcache_lru_clean, it decrements cleanup_pending and signals cleanup_cond when it hits zero; if mdcache_lru_cleanup_try_push fails due to active refs, the tracking fields are left in place so the wait still covers that entry. Finally, mdcache_exp_release calls mdcache_drain_export_cleanup() a simple cond var wait on cleanup_pending == 0 before freeing anything, guaranteeing no LRU thread or reaper can dereference the export after it is freed. Change-Id: I44f761479883e84e43f8a23f5c3a9fbe563490fd Signed-off-by: Deeraj.Patil <Deeraj.Patil(a)ibm.com> --- M src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_export.c M src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_int.h M src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_lru.c M src/FSAL/Stackable_FSALs/FSAL_MDCACHE/mdcache_main.c M src/support/exports.c 5 files changed, 121 insertions(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/96/1232496/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1232496?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I44f761479883e84e43f8a23f5c3a9fbe563490fd Gerrit-Change-Number: 1232496 Gerrit-PatchSet: 1 Gerrit-Owner: deeraj.patil(a)ibm.com

1 0