Commit b112324c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-4.8-1' of git://linux-nfs.org/~bfields/linux 

Pull nfsd fixes from Bruce Fields:
 "Fixes for the dentry refcounting leak I introduced in 4.8-rc1, and for
  races in the LOCK code which appear to go back to the big nfsd state
  lock removal from 3.17"

* tag 'nfsd-4.8-1' of git://linux-nfs.org/~bfields/linux:
  nfsd: don't return an unhashed lock stateid after taking mutex
  nfsd: Fix race between FREE_STATEID and LOCK
  nfsd: fix dentry refcounting on create
parents 9710cb66 dd257933

fs/nfsd/nfs4state.c

+48 −17
Original line number Diff line number Diff line
@@ -4903,6 +4903,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
	return nfs_ok;

}



static __be32

nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)

{

	struct nfs4_ol_stateid *stp = openlockstateid(s);

	__be32 ret;



	mutex_lock(&stp->st_mutex);



	ret = check_stateid_generation(stateid, &s->sc_stateid, 1);

	if (ret)

		goto out;



	ret = nfserr_locks_held;

	if (check_for_locks(stp->st_stid.sc_file,

			    lockowner(stp->st_stateowner)))

		goto out;



	release_lock_stateid(stp);

	ret = nfs_ok;



out:

	mutex_unlock(&stp->st_mutex);

	nfs4_put_stid(s);

	return ret;

}



__be32

nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,

		   struct nfsd4_free_stateid *free_stateid)
@@ -4910,7 +4936,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
	stateid_t *stateid = &free_stateid->fr_stateid;

	struct nfs4_stid *s;

	struct nfs4_delegation *dp;

	struct nfs4_ol_stateid *stp;

	struct nfs4_client *cl = cstate->session->se_client;

	__be32 ret = nfserr_bad_stateid;
@@ -4929,18 +4954,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
		ret = nfserr_locks_held;

		break;

	case NFS4_LOCK_STID:

		ret = check_stateid_generation(stateid, &s->sc_stateid, 1);

		if (ret)

			break;

		stp = openlockstateid(s);

		ret = nfserr_locks_held;

		if (check_for_locks(stp->st_stid.sc_file,

				    lockowner(stp->st_stateowner)))

			break;

		WARN_ON(!unhash_lock_stateid(stp));

		atomic_inc(&s->sc_count);

		spin_unlock(&cl->cl_lock);

		nfs4_put_stid(s);

		ret = nfs_ok;

		ret = nfsd4_free_lock_stateid(stateid, s);

		goto out;

	case NFS4_REVOKED_DELEG_STID:

		dp = delegstateid(s);
@@ -5507,7 +5523,7 @@ static __be32 
lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,

			    struct nfs4_ol_stateid *ost,

			    struct nfsd4_lock *lock,

			    struct nfs4_ol_stateid **lst, bool *new)

			    struct nfs4_ol_stateid **plst, bool *new)

{

	__be32 status;

	struct nfs4_file *fi = ost->st_stid.sc_file;
@@ -5515,7 +5531,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, 
	struct nfs4_client *cl = oo->oo_owner.so_client;

	struct inode *inode = d_inode(cstate->current_fh.fh_dentry);

	struct nfs4_lockowner *lo;

	struct nfs4_ol_stateid *lst;

	unsigned int strhashval;

	bool hashed;



	lo = find_lockowner_str(cl, &lock->lk_new_owner);

	if (!lo) {
@@ -5531,12 +5549,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, 
			goto out;

	}



	*lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);

	if (*lst == NULL) {

retry:

	lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);

	if (lst == NULL) {

		status = nfserr_jukebox;

		goto out;

	}



	mutex_lock(&lst->st_mutex);



	/* See if it's still hashed to avoid race with FREE_STATEID */

	spin_lock(&cl->cl_lock);

	hashed = !list_empty(&lst->st_perfile);

	spin_unlock(&cl->cl_lock);



	if (!hashed) {

		mutex_unlock(&lst->st_mutex);

		nfs4_put_stid(&lst->st_stid);

		goto retry;

	}

	status = nfs_ok;

	*plst = lst;

out:

	nfs4_put_stateowner(&lo->lo_owner);

	return status;
@@ -5603,8 +5636,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
			goto out;

		status = lookup_or_create_lock_state(cstate, open_stp, lock,

							&lock_stp, &new);

		if (status == nfs_ok)

			mutex_lock(&lock_stp->st_mutex);

	} else {

		status = nfs4_preprocess_seqid_op(cstate,

				       lock->lk_old_lock_seqid,

fs/nfsd/vfs.c

+6 −3
Original line number Diff line number Diff line
@@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, 
	if (IS_ERR(dchild))

		return nfserrno(host_err);

	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);

	if (err) {

	/*

	 * We unconditionally drop our ref to dchild as fh_compose will have

	 * already grabbed its own ref for it.

	 */

	dput(dchild);

	if (err)

		return err;

	}

	return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type,

					rdev, resfhp);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE