linux_dsm_epyc7002/fs/afs
David Howells 341f741f04 afs: Refcount the afs_call struct
A static checker warning occurs in the AFS filesystem:

	fs/afs/cmservice.c:155 SRXAFSCB_CallBack()
	error: dereferencing freed memory 'call'

due to the reply being sent before we access the server it points to.  The
act of sending the reply causes the call to be freed if an error occurs
(but not if it doesn't).

On top of this, the lifetime handling of afs_call structs is fragile
because they get passed around through workqueues without any sort of
refcounting.

Deal with the issues by:

 (1) Fix the maybe/maybe not nature of the reply sending functions with
     regards to whether they release the call struct.

 (2) Refcount the afs_call struct and sort out places that need to get/put
     references.

 (3) Pass a ref through the work queue and release (or pass on) that ref in
     the work function.  Care has to be taken because a work queue may
     already own a ref to the call.

 (4) Do the cleaning up in the put function only.

 (5) Simplify module cleanup by always incrementing afs_outstanding_calls
     whenever a call is allocated.

 (6) Set the backlog to 0 with kernel_listen() at the beginning of the
     process of closing the socket to prevent new incoming calls from
     occurring and to remove the contribution of preallocated calls from
     afs_outstanding_calls before we wait on it.

A tracepoint is also added to monitor the afs_call refcount and lifetime.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Fixes: 08e0e7c82e: "[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_RXRPC."
2017-01-09 11:10:02 +00:00
..
afs_cm.h
afs_fs.h
afs_vl.h AFS: Fix silly characters in a comment 2011-07-20 20:48:03 -04:00
afs.h afs: Support interacting with multiple user namespaces 2013-02-13 06:00:51 -08:00
cache.c
callback.c afs: Kill afs_wait_mode 2017-01-09 11:10:02 +00:00
cell.c FS-Cache: Provide the ability to enable/disable cookies 2013-09-27 18:40:25 +01:00
cmservice.c afs: Refcount the afs_call struct 2017-01-09 11:10:02 +00:00
dir.c fs: rename "rename2" i_op to "rename" 2016-09-27 11:03:58 +02:00
file.c afs: Make afs_readpages() fetch data in bulk 2017-01-06 16:54:41 +00:00
flock.c fs/afs/flock: Remove deprecated create_singlethread_workqueue 2016-09-04 21:41:39 +01:00
fsclient.c afs: Kill afs_wait_mode 2017-01-09 11:10:02 +00:00
inode.c don't put symlink bodies in pagecache into highmem 2015-12-08 22:41:36 -05:00
internal.h afs: Refcount the afs_call struct 2017-01-09 11:10:02 +00:00
Kconfig fs/afs: remove depends on CONFIG_EXPERIMENTAL 2013-01-21 14:39:04 -08:00
main.c afs: Add some tracepoints 2017-01-09 09:18:13 +00:00
Makefile
misc.c kafs: Add more "unified AFS" error codes 2015-04-01 21:36:15 +01:00
mntpt.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
netdevices.c
proc.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
rxrpc.c afs: Refcount the afs_call struct 2017-01-09 11:10:02 +00:00
security.c ->permission() sanitizing: don't pass flags to ->permission() 2011-07-20 01:43:24 -04:00
server.c rxrpc: Provide a way for AFS to ask for the peer address of a call 2016-08-30 16:07:53 +01:00
super.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
vlclient.c afs: Kill afs_wait_mode 2017-01-09 11:10:02 +00:00
vlocation.c afs: Kill afs_wait_mode 2017-01-09 11:10:02 +00:00
vnode.c afs: Kill afs_wait_mode 2017-01-09 11:10:02 +00:00
volume.c afs: Make afs_readpages() fetch data in bulk 2017-01-06 16:54:41 +00:00
write.c afs: Make afs_fs_fetch_data() take a list of pages 2017-01-06 16:54:41 +00:00