Commit 459aa077 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfs-for-5.2-2' of git://git.linux-nfs.org/projects/anna/linux-nfs 

Pull NFS client fixes from Anna Schumaker:
 "These are mostly stable bugfixes found during testing, many during the
  recent NFS bake-a-thon.

  Stable bugfixes:
   - SUNRPC: Fix regression in umount of a secure mount
   - SUNRPC: Fix a use after free when a server rejects the RPCSEC_GSS credential
   - NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
   - NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled

  Other bugfixes:
   - xprtrdma: Use struct_size() in kzalloc()"

* tag 'nfs-for-5.2-2' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  NFSv4.1: Fix bug only first CB_NOTIFY_LOCK is handled
  NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter
  SUNRPC: Fix a use after free when a server rejects the RPCSEC_GSS credential
  SUNRPC fix regression in umount of a secure mount
  xprtrdma: Use struct_size() in kzalloc()
parents 44e843eb ba851a39

fs/nfs/nfs4proc.c

+12 −20
Original line number Diff line number Diff line
@@ -6932,7 +6932,6 @@ struct nfs4_lock_waiter { 
	struct task_struct	*task;

	struct inode		*inode;

	struct nfs_lowner	*owner;

	bool			notified;

};



static int
@@ -6954,13 +6953,13 @@ nfs4_wake_lock_waiter(wait_queue_entry_t *wait, unsigned int mode, int flags, vo 
		/* Make sure it's for the right inode */

		if (nfs_compare_fh(NFS_FH(waiter->inode), &cbnl->cbnl_fh))

			return 0;



		waiter->notified = true;

	}



	/* override "private" so we can use default_wake_function */

	wait->private = waiter->task;

	ret = autoremove_wake_function(wait, mode, flags, key);

	ret = woken_wake_function(wait, mode, flags, key);

	if (ret)

		list_del_init(&wait->entry);

	wait->private = waiter;

	return ret;

}
@@ -6969,7 +6968,6 @@ static int 
nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)

{

	int status = -ERESTARTSYS;

	unsigned long flags;

	struct nfs4_lock_state *lsp = request->fl_u.nfs4_fl.owner;

	struct nfs_server *server = NFS_SERVER(state->inode);

	struct nfs_client *clp = server->nfs_client;
@@ -6979,8 +6977,7 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request) 
				    .s_dev = server->s_dev };

	struct nfs4_lock_waiter waiter = { .task  = current,

					   .inode = state->inode,

					   .owner = &owner,

					   .notified = false };

					   .owner = &owner};

	wait_queue_entry_t wait;



	/* Don't bother with waitqueue if we don't expect a callback */
@@ -6990,27 +6987,22 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request) 
	init_wait(&wait);

	wait.private = &waiter;

	wait.func = nfs4_wake_lock_waiter;

	add_wait_queue(q, &wait);



	while(!signalled()) {

		waiter.notified = false;

		add_wait_queue(q, &wait);

		status = nfs4_proc_setlk(state, cmd, request);

		if ((status != -EAGAIN) || IS_SETLK(cmd))

		if ((status != -EAGAIN) || IS_SETLK(cmd)) {

			finish_wait(q, &wait);

			break;



		status = -ERESTARTSYS;

		spin_lock_irqsave(&q->lock, flags);

		if (waiter.notified) {

			spin_unlock_irqrestore(&q->lock, flags);

			continue;

		}

		set_current_state(TASK_INTERRUPTIBLE);

		spin_unlock_irqrestore(&q->lock, flags);



		freezable_schedule_timeout(NFS4_LOCK_MAXTIMEOUT);

		status = -ERESTARTSYS;

		freezer_do_not_count();

		wait_woken(&wait, TASK_INTERRUPTIBLE, NFS4_LOCK_MAXTIMEOUT);

		freezer_count();

		finish_wait(q, &wait);

	}



	finish_wait(q, &wait);

	return status;

}

#else /* !CONFIG_NFS_V4_1 */

net/sunrpc/clnt.c

+15 −15
Original line number Diff line number Diff line
@@ -2288,13 +2288,13 @@ call_status(struct rpc_task *task) 
	case -ECONNREFUSED:

	case -ECONNRESET:

	case -ECONNABORTED:

	case -ENOTCONN:

		rpc_force_rebind(clnt);

		/* fall through */

	case -EADDRINUSE:

		rpc_delay(task, 3*HZ);

		/* fall through */

	case -EPIPE:

	case -ENOTCONN:

	case -EAGAIN:

		break;

	case -EIO:
@@ -2426,17 +2426,21 @@ call_decode(struct rpc_task *task) 
		return;

	case -EAGAIN:

		task->tk_status = 0;

		/* Note: rpc_decode_header() may have freed the RPC slot */

		if (task->tk_rqstp == req) {

		xdr_free_bvec(&req->rq_rcv_buf);

		req->rq_reply_bytes_recvd = 0;

		req->rq_rcv_buf.len = 0;

		if (task->tk_client->cl_discrtry)

			xprt_conditional_disconnect(req->rq_xprt,

						    req->rq_connect_cookie);

		}

		task->tk_action = call_encode;

		rpc_check_timeout(task);

		break;

	case -EKEYREJECTED:

		task->tk_action = call_reserve;

		rpc_check_timeout(task);

		rpcauth_invalcred(task);

		/* Ensure we obtain a new XID if we retry! */

		xprt_release(task);

	}

}
@@ -2572,11 +2576,7 @@ out_msg_denied: 
			break;

		task->tk_cred_retry--;

		trace_rpc__stale_creds(task);

		rpcauth_invalcred(task);

		/* Ensure we obtain a new XID! */

		xprt_release(task);

		task->tk_action = call_reserve;

		return -EAGAIN;

		return -EKEYREJECTED;

	case rpc_autherr_badcred:

	case rpc_autherr_badverf:

		/* possibly garbled cred/verf? */

net/sunrpc/xprtrdma/verbs.c

+1 −2
Original line number Diff line number Diff line
@@ -810,8 +810,7 @@ static struct rpcrdma_sendctx *rpcrdma_sendctx_create(struct rpcrdma_ia *ia) 
{

	struct rpcrdma_sendctx *sc;



	sc = kzalloc(sizeof(*sc) +

		     ia->ri_max_send_sges * sizeof(struct ib_sge),

	sc = kzalloc(struct_size(sc, sc_sges, ia->ri_max_send_sges),

		     GFP_KERNEL);

	if (!sc)

		return NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE