Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd257933 authored by Jeff Layton's avatar Jeff Layton Committed by J. Bruce Fields
Browse files

nfsd: don't return an unhashed lock stateid after taking mutex 



nfsd4_lock will take the st_mutex before working with the stateid it
gets, but between the time when we drop the cl_lock and take the mutex,
the stateid could become unhashed (a'la FREE_STATEID). If that happens
the lock stateid returned to the client will be forgotten.

Fix this by first moving the st_mutex acquisition into
lookup_or_create_lock_state. Then, have it check to see if the lock
stateid is still hashed after taking the mutex. If it's not, then put
the stateid and try the find/create again.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Tested-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
Cc: stable@vger.kernel.org # feb9dad5 nfsd: Always lock state exclusively.
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 42691398

fs/nfsd/nfs4state.c

+20 −5
Original line number Diff line number Diff line
@@ -5523,7 +5523,7 @@ static __be32 
lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,

			    struct nfs4_ol_stateid *ost,

			    struct nfsd4_lock *lock,

			    struct nfs4_ol_stateid **lst, bool *new)

			    struct nfs4_ol_stateid **plst, bool *new)

{

	__be32 status;

	struct nfs4_file *fi = ost->st_stid.sc_file;
@@ -5531,7 +5531,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, 
	struct nfs4_client *cl = oo->oo_owner.so_client;

	struct inode *inode = d_inode(cstate->current_fh.fh_dentry);

	struct nfs4_lockowner *lo;

	struct nfs4_ol_stateid *lst;

	unsigned int strhashval;

	bool hashed;



	lo = find_lockowner_str(cl, &lock->lk_new_owner);

	if (!lo) {
@@ -5547,12 +5549,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, 
			goto out;

	}



	*lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);

	if (*lst == NULL) {

retry:

	lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);

	if (lst == NULL) {

		status = nfserr_jukebox;

		goto out;

	}



	mutex_lock(&lst->st_mutex);



	/* See if it's still hashed to avoid race with FREE_STATEID */

	spin_lock(&cl->cl_lock);

	hashed = !list_empty(&lst->st_perfile);

	spin_unlock(&cl->cl_lock);



	if (!hashed) {

		mutex_unlock(&lst->st_mutex);

		nfs4_put_stid(&lst->st_stid);

		goto retry;

	}

	status = nfs_ok;

	*plst = lst;

out:

	nfs4_put_stateowner(&lo->lo_owner);

	return status;
@@ -5619,8 +5636,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
			goto out;

		status = lookup_or_create_lock_state(cstate, open_stp, lock,

							&lock_stp, &new);

		if (status == nfs_ok)

			mutex_lock(&lock_stp->st_mutex);

	} else {

		status = nfs4_preprocess_seqid_op(cstate,

				       lock->lk_old_lock_seqid,