Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ae67c4f authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4: It is not safe to dereference lsp->ls_state in release_lockowner 



It is quite possible for the release_lockowner RPC call to race with the
close RPC call, in which case, we cannot dereference lsp->ls_state in
order to find the nfs_server.

Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent c4f1b62a

fs/nfs/nfs4_fs.h

+1 −1
Original line number Diff line number Diff line
@@ -340,7 +340,7 @@ extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid); 
extern void nfs_release_seqid(struct nfs_seqid *seqid);

extern void nfs_free_seqid(struct nfs_seqid *seqid);



extern void nfs4_free_lock_state(struct nfs4_lock_state *lsp);

extern void nfs4_free_lock_state(struct nfs_server *server, struct nfs4_lock_state *lsp);



extern const nfs4_stateid zero_stateid;

fs/nfs/nfs4proc.c

+3 −1
Original line number Diff line number Diff line
@@ -4760,13 +4760,14 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl) 


struct nfs_release_lockowner_data {

	struct nfs4_lock_state *lsp;

	struct nfs_server *server;

	struct nfs_release_lockowner_args args;

};



static void nfs4_release_lockowner_release(void *calldata)

{

	struct nfs_release_lockowner_data *data = calldata;

	nfs4_free_lock_state(data->lsp);

	nfs4_free_lock_state(data->server, data->lsp);

	kfree(calldata);

}
@@ -4788,6 +4789,7 @@ int nfs4_release_lockowner(struct nfs4_lock_state *lsp) 
	if (!data)

		return -ENOMEM;

	data->lsp = lsp;

	data->server = server;

	data->args.lock_owner.clientid = server->nfs_client->cl_clientid;

	data->args.lock_owner.id = lsp->ls_seqid.owner_id;

	data->args.lock_owner.s_dev = server->s_dev;

fs/nfs/nfs4state.c

+3 −5
Original line number Diff line number Diff line
@@ -791,10 +791,8 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f 
	return NULL;

}



void nfs4_free_lock_state(struct nfs4_lock_state *lsp)

void nfs4_free_lock_state(struct nfs_server *server, struct nfs4_lock_state *lsp)

{

	struct nfs_server *server = lsp->ls_state->owner->so_server;



	ida_simple_remove(&server->lockowner_id, lsp->ls_seqid.owner_id);

	nfs4_destroy_seqid_counter(&lsp->ls_seqid);

	kfree(lsp);
@@ -828,7 +826,7 @@ static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_ 
	}

	spin_unlock(&state->state_lock);

	if (new != NULL)

		nfs4_free_lock_state(new);

		nfs4_free_lock_state(state->owner->so_server, new);

	return lsp;

}
@@ -853,7 +851,7 @@ void nfs4_put_lock_state(struct nfs4_lock_state *lsp) 
		if (nfs4_release_lockowner(lsp) == 0)

			return;

	}

	nfs4_free_lock_state(lsp);

	nfs4_free_lock_state(lsp->ls_state->owner->so_server, lsp);

}



static void nfs4_fl_copy_lock(struct file_lock *dst, struct file_lock *src)