NFSv4.1: Fix a race in nfs4_proc_layoutget (bd171930) · Commits · 戴 / test

If the task calling layoutget is signalled, then it is possible for the calls to nfs4_sequence_free_slot() and nfs4_layoutget_prepare() to race, in which case we leak a slot. The fix is to move the call to nfs4_sequence_free_slot() into the nfs4_layoutget_release() so that it gets called at task teardown time. Fixes: ("NFSv4.1: Close callback races for OPEN, LAYOUTGET...") Cc: stable@vger.kernel.org # v4.8+ Signed-off-by:

Trond Myklebust <trond.myklebust@primarydata.com>

fs/nfs/nfs4proc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -8417,6 +8417,7 @@ static void nfs4_layoutget_release(void *calldata)
		size_t max_pages = max_response_pages(server);

		dprintk("--> %s\n", __func__);
		nfs4_sequence_free_slot(&lgp->res.seq_res);
		nfs4_free_pages(lgp->args.layout.pages, max_pages);
		pnfs_put_layout_hdr(NFS_I(inode)->layout);
		put_nfs_open_context(lgp->args.ctx);
		@@ -8491,7 +8492,6 @@ nfs4_proc_layoutget(struct nfs4_layoutget lgp, long timeout, gfp_t gfp_flags)
		/* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
		if (status == 0 && lgp->res.layoutp->len)
		lseg = pnfs_layout_process(lgp);
		nfs4_sequence_free_slot(&lgp->res.seq_res);
		rpc_put_task(task);
		dprintk("<-- %s status=%d\n", __func__, status);
		if (status)

Admin message