Commit 642fe4d0 authored Nov 08, 2012 by Trond Myklebust

SUNRPC: Fix validity issues with rpc_pipefs sb->s_fs_info

rpc_kill_sb() must defer calling put_net() until after the notifier
has been called, since most (all?) of the notifier callbacks assume
that sb->s_fs_info points to a valid net namespace. It also must not
call put_net() if the call to rpc_fill_super was unsuccessful.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=48421



Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: stable@vger.kernel.org [>= v3.4]

parent 0e4a43ed

net/sunrpc/rpc_pipe.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -1152,14 +1152,19 @@ static void rpc_kill_sb(struct super_block *sb)
		struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);

		mutex_lock(&sn->pipefs_sb_lock);
		if (sn->pipefs_sb != sb) {
		mutex_unlock(&sn->pipefs_sb_lock);
		goto out;
		}
		sn->pipefs_sb = NULL;
		mutex_unlock(&sn->pipefs_sb_lock);
		put_net(net);
		dprintk("RPC: sending pipefs UMOUNT notification for net %p%s\n",
		net, NET_NAME(net));
		blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
		RPC_PIPEFS_UMOUNT,
		sb);
		put_net(net);
		out:
		kill_litter_super(sb);
		}