Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 910a98e5 authored by Trond Myklebust's avatar Trond Myklebust Committed by Greg Kroah-Hartman
Browse files

NFSv4/pNFS: Fix another issue with a list iterator pointing to the head 



[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ]

In nfs4_callback_devicenotify(), if we don't find a matching entry for
the deviceid, we're left with a pointer to 'struct nfs_server' that
actually points to the list of super blocks associated with our struct
nfs_client.
Furthermore, even if we have a valid pointer, nothing pins the super
block, and so the struct nfs_server could end up getting freed while
we're using it.

Since all we want is a pointer to the struct pnfs_layoutdriver_type,
let's skip all the iteration over super blocks, and just use APIs to
find the layout driver directly.

Reported-by: default avatarXiaomeng Tong <xiam0nd.tong@gmail.com>
Fixes: 1be5683b ("pnfs: CB_NOTIFY_DEVICEID")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 9acf05b4

fs/nfs/callback_proc.c

+9 −18
Original line number Diff line number Diff line
@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, 
				  struct cb_process_state *cps)

{

	struct cb_devicenotifyargs *args = argp;

	const struct pnfs_layoutdriver_type *ld = NULL;

	uint32_t i;

	__be32 res = 0;

	struct nfs_client *clp = cps->clp;

	struct nfs_server *server = NULL;



	if (!clp) {

	if (!cps->clp) {

		res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION);

		goto out;

	}
@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, 
	for (i = 0; i < args->ndevs; i++) {

		struct cb_devicenotifyitem *dev = &args->devs[i];



		if (!server ||

		    server->pnfs_curr_ld->id != dev->cbd_layout_type) {

			rcu_read_lock();

			list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link)

				if (server->pnfs_curr_ld &&

				    server->pnfs_curr_ld->id == dev->cbd_layout_type) {

					rcu_read_unlock();

					goto found;

				}

			rcu_read_unlock();

		if (!ld || ld->id != dev->cbd_layout_type) {

			pnfs_put_layoutdriver(ld);

			ld = pnfs_find_layoutdriver(dev->cbd_layout_type);

			if (!ld)

				continue;

		}



	found:

		nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id);

		nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id);

	}



	pnfs_put_layoutdriver(ld);

out:

	kfree(args->devs);

	return res;

fs/nfs/pnfs.c

+11 −0
Original line number Diff line number Diff line
@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) 
	return local;

}



const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id)

{

	return find_pnfs_driver(id);

}



void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld)

{

	if (ld)

		module_put(ld->owner);

}



void

unset_pnfs_layoutdriver(struct nfs_server *nfss)

{

fs/nfs/pnfs.h

+2 −0
Original line number Diff line number Diff line
@@ -226,6 +226,8 @@ struct pnfs_devicelist { 


extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *);

extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *);

extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id);

extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld);



/* nfs4proc.c */

extern size_t max_response_pages(struct nfs_server *server);