Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd171930 authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4.1: Fix a race in nfs4_proc_layoutget 



If the task calling layoutget is signalled, then it is possible for the
calls to nfs4_sequence_free_slot() and nfs4_layoutget_prepare() to race,
in which case we leak a slot.
The fix is to move the call to nfs4_sequence_free_slot() into the
nfs4_layoutget_release() so that it gets called at task teardown time.

Fixes: 2e80dbe7 ("NFSv4.1: Close callback races for OPEN, LAYOUTGET...")
Cc: stable@vger.kernel.org # v4.8+
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent 898fc11b

fs/nfs/nfs4proc.c

+1 −1
Original line number Diff line number Diff line
@@ -8417,6 +8417,7 @@ static void nfs4_layoutget_release(void *calldata) 
	size_t max_pages = max_response_pages(server);



	dprintk("--> %s\n", __func__);

	nfs4_sequence_free_slot(&lgp->res.seq_res);

	nfs4_free_pages(lgp->args.layout.pages, max_pages);

	pnfs_put_layout_hdr(NFS_I(inode)->layout);

	put_nfs_open_context(lgp->args.ctx);
@@ -8491,7 +8492,6 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags) 
	/* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */

	if (status == 0 && lgp->res.layoutp->len)

		lseg = pnfs_layout_process(lgp);

	nfs4_sequence_free_slot(&lgp->res.seq_res);

	rpc_put_task(task);

	dprintk("<-- %s status=%d\n", __func__, status);

	if (status)