Commit 080af20c authored by Steve Dickson's avatar Steve Dickson Committed by Trond Myklebust
Browse files

NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists() 



There is a race between nfs4_state_manager() and
nfs_server_remove_lists() that happens during a nfsv3 mount.

The v3 mount notices there is already a supper block so
nfs_server_remove_lists() called which uses the nfs_client_lock
spin lock to synchronize access to the client list.

At the same time nfs4_state_manager() is running through
the client list looking for work to do, using the same
lock. When nfs4_state_manager() wins the race to the
list, a v3 client pointer is found and not ignored
properly which causes the panic.

Moving some protocol checks before the state checking
avoids the panic.

CC: Stable Tree <stable@vger.kernel.org>
Signed-off-by: default avatarSteve Dickson <steved@redhat.com>
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent f39c0104

fs/nfs/nfs4client.c

+20 −18
Original line number Original line Diff line number Diff line
@@ -482,6 +482,16 @@ int nfs40_walk_client_list(struct nfs_client *new, 




	spin_lock(&nn->nfs_client_lock);

	spin_lock(&nn->nfs_client_lock);

	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {

	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {



		if (pos->rpc_ops != new->rpc_ops)

			continue;



		if (pos->cl_proto != new->cl_proto)

			continue;



		if (pos->cl_minorversion != new->cl_minorversion)

			continue;



		/* If "pos" isn't marked ready, we can't trust the

		/* If "pos" isn't marked ready, we can't trust the

		 * remaining fields in "pos" */

		 * remaining fields in "pos" */

		if (pos->cl_cons_state > NFS_CS_READY) {

		if (pos->cl_cons_state > NFS_CS_READY) {
@@ -501,15 +511,6 @@ int nfs40_walk_client_list(struct nfs_client *new, 
		if (pos->cl_cons_state != NFS_CS_READY)

		if (pos->cl_cons_state != NFS_CS_READY)

			continue;

			continue;





		if (pos->rpc_ops != new->rpc_ops)

			continue;



		if (pos->cl_proto != new->cl_proto)

			continue;



		if (pos->cl_minorversion != new->cl_minorversion)

			continue;



		if (pos->cl_clientid != new->cl_clientid)

		if (pos->cl_clientid != new->cl_clientid)

			continue;

			continue;
@@ -622,6 +623,16 @@ int nfs41_walk_client_list(struct nfs_client *new, 




	spin_lock(&nn->nfs_client_lock);

	spin_lock(&nn->nfs_client_lock);

	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {

	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {



		if (pos->rpc_ops != new->rpc_ops)

			continue;



		if (pos->cl_proto != new->cl_proto)

			continue;



		if (pos->cl_minorversion != new->cl_minorversion)

			continue;



		/* If "pos" isn't marked ready, we can't trust the

		/* If "pos" isn't marked ready, we can't trust the

		 * remaining fields in "pos", especially the client

		 * remaining fields in "pos", especially the client

		 * ID and serverowner fields.  Wait for CREATE_SESSION

		 * ID and serverowner fields.  Wait for CREATE_SESSION
@@ -647,15 +658,6 @@ int nfs41_walk_client_list(struct nfs_client *new, 
		if (pos->cl_cons_state != NFS_CS_READY)

		if (pos->cl_cons_state != NFS_CS_READY)

			continue;

			continue;





		if (pos->rpc_ops != new->rpc_ops)

			continue;



		if (pos->cl_proto != new->cl_proto)

			continue;



		if (pos->cl_minorversion != new->cl_minorversion)

			continue;



		if (!nfs4_match_clientids(pos, new))

		if (!nfs4_match_clientids(pos, new))

			continue;

			continue;

CRA Git | Maintained and supported by SUSTech CRA and CCSE