[src/trunk]: src/sys/fs/puffs Fix PUFFS node use-after-reclaim

[manu <manu%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/09f772963f00
branches:  trunk
changeset: 333440:09f772963f00
user:      manu <manu%NetBSD.org@localhost>
date:      Tue Nov 04 09:10:37 2014 +0000

description:
Fix PUFFS node use-after-reclaim

When puffs_cookie2vnode() misses an entry, vcache_get()
creates a new node (puffs_vfsop_loadvnode being called to
initialize the PUFFS part), then it discovers it is VNON,
and tries to vrele() it. vrele() calls VOP_INACTIVE(),
which led us in puffs_vnop_inactive() where we sent a
request to the filesystem for a node that already had been
reclaimed.

The fix is to check for VNON nodes in puffs_vnop_inactive()
and to return without doing anyting. This is suboptimal, but
a better workaround would probably need to modify vcache API,
with an impact on other filesystems. Let us keep it simple.

diffstat:

 sys/fs/puffs/puffs_node.c  |   5 +++--
 sys/fs/puffs/puffs_vnops.c |  16 ++++++++++++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diffs (63 lines):

diff -r 9df08d4a0da7 -r 09f772963f00 sys/fs/puffs/puffs_node.c
--- a/sys/fs/puffs/puffs_node.c Tue Nov 04 08:05:21 2014 +0000
+++ b/sys/fs/puffs/puffs_node.c Tue Nov 04 09:10:37 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: puffs_node.c,v 1.34 2014/09/30 10:15:03 hannken Exp $  */
+/*     $NetBSD: puffs_node.c,v 1.35 2014/11/04 09:10:37 manu Exp $     */
 
 /*
  * Copyright (c) 2005, 2006, 2007  Antti Kantee.  All Rights Reserved.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: puffs_node.c,v 1.34 2014/09/30 10:15:03 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: puffs_node.c,v 1.35 2014/11/04 09:10:37 manu Exp $");
 
 #include <sys/param.h>
 #include <sys/hash.h>
@@ -266,6 +266,7 @@
        mutex_enter((*vpp)->v_interlock);
        if ((*vpp)->v_type == VNON) {
                mutex_exit((*vpp)->v_interlock);
+               /* XXX vrele() calls VOP_INACTIVE() with VNON node */
                vrele(*vpp);
                *vpp = NULL;
                return PUFFS_NOSUCHCOOKIE;
diff -r 9df08d4a0da7 -r 09f772963f00 sys/fs/puffs/puffs_vnops.c
--- a/sys/fs/puffs/puffs_vnops.c        Tue Nov 04 08:05:21 2014 +0000
+++ b/sys/fs/puffs/puffs_vnops.c        Tue Nov 04 09:10:37 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: puffs_vnops.c,v 1.196 2014/10/31 13:52:41 manu Exp $   */
+/*     $NetBSD: puffs_vnops.c,v 1.197 2014/11/04 09:10:37 manu Exp $   */
 
 /*
  * Copyright (c) 2005, 2006, 2007  Antti Kantee.  All Rights Reserved.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: puffs_vnops.c,v 1.196 2014/10/31 13:52:41 manu Exp $");
+__KERNEL_RCSID(0, "$NetBSD: puffs_vnops.c,v 1.197 2014/11/04 09:10:37 manu Exp $");
 
 #include <sys/param.h>
 #include <sys/buf.h>
@@ -1330,6 +1330,18 @@
        struct puffs_node *pnode;
        bool recycle = false;
 
+       /*
+        * When puffs_cookie2vnode() misses an entry, vcache_get()
+        * creates a new node (puffs_vfsop_loadvnode being called to
+        * initialize the PUFFS part), then it discovers it is VNON,
+        * and tries to vrele() it. This leads us there, while the 
+        * cookie was stall and the node likely already reclaimed. 
+        */
+       if (vp->v_type == VNON) {
+               VOP_UNLOCK(vp);
+               return 0;
+       }
+
        pnode = vp->v_data;
        mutex_enter(&pnode->pn_sizemtx);