Re: [PATCH] afs: Fix endless loop in directory parsing

[Marc Dionne]

On Fri, Feb 23, 2024 at 9:15 AM David Howells <dhowells@xxxxxxxxxx> wrote:
>
>
> If a directory has a block with only ".__afsXXXX" files in it (from
> uncompleted silly-rename), these .__afsXXXX files are skipped but without
> advancing the file position in the dir_context.  This leads to
> afs_dir_iterate() repeating the block again and again.
>
> Fix this by making the code that skips the .__afsXXXX file also manually
> advance the file position.
>
> The symptoms are a soft lookup:
>
>         watchdog: BUG: soft lockup - CPU#3 stuck for 52s! [check:5737]
>         ...
>         RIP: 0010:afs_dir_iterate_block+0x39/0x1fd
>         ...
>          ? watchdog_timer_fn+0x1a6/0x213
>         ...
>          ? asm_sysvec_apic_timer_interrupt+0x16/0x20
>          ? afs_dir_iterate_block+0x39/0x1fd
>          afs_dir_iterate+0x10a/0x148
>          afs_readdir+0x30/0x4a
>          iterate_dir+0x93/0xd3
>          __do_sys_getdents64+0x6b/0xd4
>
> This is almost certainly the actual fix for:
>
>         https://bugzilla.kernel.org/show_bug.cgi?id=218496
>
> Fixes: 57e9d49c5452 ("afs: Hide silly-rename files from userspace")
> Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
> cc: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
> cc: Markus Suvanto <markus.suvanto@xxxxxxxxx>
> cc: linux-afs@xxxxxxxxxxxxxxxxxxx
> ---
>  fs/afs/dir.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/afs/dir.c b/fs/afs/dir.c
> index b5b8de521f99..8a67fc427e74 100644
> --- a/fs/afs/dir.c
> +++ b/fs/afs/dir.c
> @@ -479,8 +479,10 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
>                     dire->u.name[0] == '.' &&
>                     ctx->actor != afs_lookup_filldir &&
>                     ctx->actor != afs_lookup_one_filldir &&
> -                   memcmp(dire->u.name, ".__afs", 6) == 0)
> +                   memcmp(dire->u.name, ".__afs", 6) == 0) {
> +                       ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
>                         continue;
> +               }
>
>                 /* found the next entry */
>                 if (!dir_emit(ctx, dire->u.name, nlen,

Reviewed-by: Marc Dionne <marc.dionne@xxxxxxxxxxxx>

Marc