Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed1e6211 authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFSv4: Don't use the delegation->inode in nfs_mark_return_delegation() 



nfs_mark_return_delegation() is usually called without any locking, and
so it is not safe to dereference delegation->inode. Since the inode is
only used to discover the nfs_client anyway, it makes more sense to
have the callers pass a valid pointer to the nfs_server as a parameter.

Reported-by: default avatarIan Kent <raven@themaw.net>
Cc: stable@kernel.org
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 73ca1001

fs/nfs/delegation.c

+8 −8
Original line number Diff line number Diff line
@@ -398,12 +398,11 @@ int nfs_inode_return_delegation(struct inode *inode) 
	return err;

}



static void nfs_mark_return_delegation(struct nfs_delegation *delegation)

static void nfs_mark_return_delegation(struct nfs_server *server,

		struct nfs_delegation *delegation)

{

	struct nfs_client *clp = NFS_SERVER(delegation->inode)->nfs_client;



	set_bit(NFS_DELEGATION_RETURN, &delegation->flags);

	set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);

	set_bit(NFS4CLNT_DELEGRETURN, &server->nfs_client->cl_state);

}



/**
@@ -441,7 +440,7 @@ static void nfs_mark_return_all_delegation_types(struct nfs_server *server, 
		if ((delegation->type == (FMODE_READ|FMODE_WRITE)) && !(flags & FMODE_WRITE))

			continue;

		if (delegation->type & flags)

			nfs_mark_return_delegation(delegation);

			nfs_mark_return_delegation(server, delegation);

	}

}
@@ -508,7 +507,7 @@ static void nfs_mark_return_unreferenced_delegations(struct nfs_server *server) 
	list_for_each_entry_rcu(delegation, &server->delegations, super_list) {

		if (test_and_clear_bit(NFS_DELEGATION_REFERENCED, &delegation->flags))

			continue;

		nfs_mark_return_delegation(delegation);

		nfs_mark_return_delegation(server, delegation);

	}

}
@@ -539,7 +538,8 @@ void nfs_expire_unreferenced_delegations(struct nfs_client *clp) 
int nfs_async_inode_return_delegation(struct inode *inode,

				      const nfs4_stateid *stateid)

{

	struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;

	struct nfs_server *server = NFS_SERVER(inode);

	struct nfs_client *clp = server->nfs_client;

	struct nfs_delegation *delegation;



	rcu_read_lock();
@@ -549,7 +549,7 @@ int nfs_async_inode_return_delegation(struct inode *inode, 
		rcu_read_unlock();

		return -ENOENT;

	}

	nfs_mark_return_delegation(delegation);

	nfs_mark_return_delegation(server, delegation);

	rcu_read_unlock();



	nfs_delegation_run_state_manager(clp);