Bug #8805

xattr_dir_lookup() can leak a vnode hold

Added by Vitaliy Gusev 11 months ago. Updated 9 months ago.

Status:ClosedStart date:2017-11-15
Priority:NormalDue date:
Assignee:Vitaliy Gusev% Done:

100%

Category:kernel
Target version:-
Difficulty:Medium Tags:needs-triage

Description

When vnode is leaked, directory can not be umounted:

~# zfs umount rpool/T2
cannot unmount '/rpool/T2': Device busy

Steps to reproduce (host should have CPU >= 2 cores):

  1. Compile attached test: gcc xattr_test_loop.c -o xtest
  2. Create dataset: zfs create rpool/T2
  3. Run two instances of xtest: ./xtest /rpool/T2 "a" & ./xtest /rpool/T2 "a" &

xattr_test_loop.c Magnifier (564 Bytes) Vitaliy Gusev, 2017-11-15 01:30 PM

fix-illumos-8805.patch Magnifier - possible fix (1.02 KB) Vitaliy Gusev, 2017-11-15 01:36 PM

History

#1 Updated by Vitaliy Gusev 11 months ago

#2 Updated by Gordon Ross 11 months ago

Interesting! Can you please add a write-up on how the leaked hold happens?

#3 Updated by Vitaliy Gusev 11 months ago

Gordon Ross wrote:

Interesting! Can you please add a write-up on how the leaked hold happens?

Look at fixing patch. Comments and assumption from author was wrong: Winner already held @dvp and "looser" has to release @dvp which was held in gfs_file_create()

#5 Updated by Electric Monk 9 months ago

  • % Done changed from 0 to 100
  • Status changed from New to Closed

git commit f4f14d92e23977993fc16fdcece27ba510a6d40b

commit  f4f14d92e23977993fc16fdcece27ba510a6d40b
Author: Vitaliy Gusev <gusev.vitaliy@gmail.com>
Date:   2018-01-24T14:32:29.000Z

    8805 xattr_dir_lookup() can leak a vnode hold
    Reviewed by: Marcel Telka <marcel@telka.sk>
    Reviewed by: Gordon Ross <gordon.w.ross@gmail.com>
    Approved by: Dan McDonald <danmcd@joyent.com>

Also available in: Atom