From: Namjae Jeon <linkinjeon@kernel.org>
To: Marios Makassikis <mmakassikis@freebox.fr>
Cc: linux-cifs@vger.kernel.org
Subject: Re: [PATCH] ksmbd: fix recursive locking in RPC handle list access
Date: Wed, 15 Oct 2025 16:53:16 +0900 [thread overview]
Message-ID: <CAKYAXd9keP-3G7RTTXWn8E9uU2ij1napBZDXasSBFJHLzVgEug@mail.gmail.com> (raw)
In-Reply-To: <20251015072546.3941890-1-mmakassikis@freebox.fr>
On Wed, Oct 15, 2025 at 4:36 PM Marios Makassikis
<mmakassikis@freebox.fr> wrote:
>
> Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list
> access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
>
> This causes hung connections / tasks when a client attempts to open
> a named pipe. Using Samba's rpcclient tool:
>
> $ rpcclient //192.168.1.254 -U user%password
> $ rpcclient $> srvinfo
> <connection hung here>
>
> Kernel side:
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
> Workqueue: ksmbd-io handle_ksmbd_work
> Call trace:
> __schedule from schedule+0x3c/0x58
> schedule from schedule_preempt_disabled+0xc/0x10
> schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8
> rwsem_down_read_slowpath from down_read+0x28/0x30
> down_read from ksmbd_session_rpc_method+0x18/0x3c
> ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68
> ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228
> ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8
> create_smb2_pipe from smb2_open+0x10c/0x27ac
> smb2_open from handle_ksmbd_work+0x238/0x3dc
> handle_ksmbd_work from process_scheduled_works+0x160/0x25c
> process_scheduled_works from worker_thread+0x16c/0x1e8
> worker_thread from kthread+0xa8/0xb8
> kthread from ret_from_fork+0x14/0x38
> Exception stack(0x8529ffb0 to 0x8529fff8)
>
> The task deadlocks because the lock is already held:
> ksmbd_session_rpc_open
> down_write(&sess->rpc_lock)
> ksmbd_rpc_open
> ksmbd_session_rpc_method
> down_read(&sess->rpc_lock) <-- deadlock
>
> Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
>
> Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
> Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access")
Applied it to #ksmbd-for-next-next.
Thanks!
prev parent reply other threads:[~2025-10-15 7:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-15 7:25 [PATCH] ksmbd: fix recursive locking in RPC handle list access Marios Makassikis
2025-10-15 7:53 ` Namjae Jeon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKYAXd9keP-3G7RTTXWn8E9uU2ij1napBZDXasSBFJHLzVgEug@mail.gmail.com \
--to=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=mmakassikis@freebox.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).