[Bugs] [Bug 1421759] Gluster NFS server crashing in __mnt3svc_umountall

[bugzilla at redhat.com]

https://bugzilla.redhat.com/show_bug.cgi?id=1421759

Niels de Vos <ndevos at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED
           Assignee|bugs at gluster.org            |skoduri at redhat.com
              Flags|                            |needinfo?(skoduri at redhat.co
                   |                            |m)



--- Comment #4 from Niels de Vos <ndevos at redhat.com> ---
You have a good theory on how this use-after-free can occur. You should be able
to reproduce this with nfsshell from https://github.com/NetDirect/nfsshell as
it can do UMNTALL too. Using this program it should be possible to trigger the
problem. An example for running the shell is like:

    $ ./nfsshell
    nfs> host storage.lan.nixpanic.net
    Open storage.lan.example.net (172.31.96.2) TCP
    nfs> mount /repos
    Mount `/repos', TCP, transfer size 1048576 bytes.
    nfs> ls
    .
    ..
    .trashcan
    fedora
    rhel-7
    nfs> umountall
    Unmount `/repos'
    nfs> quit
    Close `storage.lan.nixpanic.net'

You can also put the commands in a textfile and pipe that to nfsshell:

    $ cat /tmp/umountall-reproducer.nfsshell
    host storage.lan.example.net
    mount /repos
    ls
    umountall
    quit

    $ ./nfsshell < /tmp/umountall-reproducer.nfsshell
    nfs> host storage.lan.nixpanic.net
    Open storage.lan.example.net (172.31.96.2) TCP
    nfs> mount /repos
    Mount `/repos', TCP, transfer size 1048576 bytes.
    nfs> ls
    .
    ..
    .trashcan
    fedora
    rhel-7
    nfs> umountall
    Unmount `/repos'
    nfs> quit
    Close `storage.lan.nixpanic.net'

I'd appreciate it if someone can look into reproducing the problem and confirm
the patch fixes it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.