8:51 a.m.
Rajesh Prasad has uploaded this change for review. (
https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1245847?usp=email )
Change subject: Fix NULL ev_p Crash During Blocked Lock Grant
......................................................................
Fix NULL ev_p Crash During Blocked Lock Grant
Bug: Ganesha crashes with a NULL dereference in `svc_rqst_expire_insert`
when granting a blocked NFSv4 lock to a client that disconnected before
the grant was attempted.
Event Sequence:
Client A - Acquires lock on file F
Client B - Requests same lock; placed in blocked-lock queue
(`STATE_BLOCKING`)
Client B - Disconnect — `svc_rqst_unreg()` clears `rec->ev_p = NULL
Client A - Issues `LOCKU` — lock released
Ganesha - Calls `grant_blocked_locks()` — Client B's entry is the
first candidate
Ganesha - `nfsv4_granted_callback()` → `nfs_rpc_cb_single()` →
`nfs_rpc_call()` → `CLNT_CALL_BACK()` →
`clnt_req_callback()` → `svc_rqst_expire_insert()`
CRASH - `sr_rec = cx->cx_rec->ev_p` is `NULL` →
`mutex_lock(sr_rec->)` → SIGSEGV
Fix:
Before building the `CB_COMPOUND` payload, verify the client still has a
working back channel.
NFSv4.0 — read the `cb_chan_down` flag
NFSv4.1/4.2 — scan `cb_session_list` under `cid_mutex` for any
session that has `session_bc_up` set
Handle RPC failure case -
Covers the narrow race where the transport is destroyed after the
pre-check passes but before (or during) the RPC send. If RPC failed,
remove entry, try next.
Used `STATE_ESTALE` to cleans up correctly -
`try_to_grant_lock()` handles the return value of the callback:
```
STATE_LOCK_BLOCKED → restore sle_blocked, leave in list (will retry)
STATE_SUCCESS → return (lock granted, entry promoted)
anything else → fall through to remove_from_locklist()
```
`STATE_ESTALE` is "anything else", so the entry is removed.
`grant_blocked_locks()` uses `glist_for_each_safe`, so after the entry
is removed the loop automatically advances to the next blocked waiter.
Change-Id: I119d51ff60fb20022a1e38e3c1c510da8f45dcb2
Signed-off-by: Rajesh Prasad <raprasad(a)redhat.com>
---
M src/Protocols/NFS/nfs4_op_lock.c
1 file changed, 69 insertions(+), 7 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/47/1245847/1
--
To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1245847?usp=email
To unsubscribe, or for help writing mail filters, visit
https://review.gerrithub.io/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: ffilz/nfs-ganesha
Gerrit-Branch: next
Gerrit-Change-Id: I119d51ff60fb20022a1e38e3c1c510da8f45dcb2
Gerrit-Change-Number: 1245847
Gerrit-PatchSet: 1
Gerrit-Owner: Rajesh Prasad <raprasad(a)redhat.com>