evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NFSv4: Fix NFSv4 reference counting for trunked sessions

Browse source 
The reference counting in nfs4_init_client assumes wongly that it
is safe for nfs4_discover_server_trunking() to return a pointer to a
nfs_client prior to bumping the reference count.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Chuck Lever <chuck.lever@oracle.com>
Cc: Ben Greear <greearb@candelatech.com>
Cc: stable@vger.kernel.org [>=3.7]
This commit is contained in:
Trond Myklebust 2013-01-18 22:41:53 -05:00
parent dee972b967
commit 4ae19c2dd7
1 changed files with 15 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
fs/nfs/nfs4client.c
View file

@ -236,11 +236,10 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
error = nfs4_discover_server_trunking(clp, &old); error = nfs4_discover_server_trunking(clp, &old);
if (error < 0) if (error < 0)
goto error; goto error;
nfs_put_client(clp);
if (clp != old) { if (clp != old) {
clp->cl_preserve_clid = true; clp->cl_preserve_clid = true;
nfs_put_client(clp);
clp = old; clp = old;
atomic_inc(&clp->cl_count);
} }
return clp; return clp;
@ -306,7 +305,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
.clientid = new->cl_clientid, .clientid = new->cl_clientid,
.confirm = new->cl_confirm, .confirm = new->cl_confirm,
}; };
int status; int status = -NFS4ERR_STALE_CLIENTID;
spin_lock(&nn->nfs_client_lock); spin_lock(&nn->nfs_client_lock);
list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) { list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
@ -332,28 +331,28 @@ int nfs40_walk_client_list(struct nfs_client *new,
if (prev) if (prev)
nfs_put_client(prev); nfs_put_client(prev);
prev = pos;
status = nfs4_proc_setclientid_confirm(pos, &clid, cred); status = nfs4_proc_setclientid_confirm(pos, &clid, cred);
if (status == 0) { switch (status) {
case -NFS4ERR_STALE_CLIENTID:
break;
case 0:
nfs4_swap_callback_idents(pos, new); nfs4_swap_callback_idents(pos, new);
nfs_put_client(pos); prev = NULL;
*result = pos; *result = pos;
dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n", dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
__func__, pos, atomic_read(&pos->cl_count)); __func__, pos, atomic_read(&pos->cl_count));
return 0; default:
} goto out;
if (status != -NFS4ERR_STALE_CLIENTID) {
nfs_put_client(pos);
dprintk("NFS: <-- %s status = %d, no result\n",
__func__, status);
return status;
} }
spin_lock(&nn->nfs_client_lock); spin_lock(&nn->nfs_client_lock);
prev = pos;
} }
spin_unlock(&nn->nfs_client_lock);
out:
/* /*
* No matching nfs_client found. This should be impossible, * No matching nfs_client found. This should be impossible,
* because the new nfs_client has already been added to * because the new nfs_client has already been added to
@ -363,9 +362,8 @@ int nfs40_walk_client_list(struct nfs_client *new,
*/ */
if (prev) if (prev)
nfs_put_client(prev); nfs_put_client(prev);
spin_unlock(&nn->nfs_client_lock); dprintk("NFS: <-- %s status = %d\n", __func__, status);
pr_err("NFS: %s Error: no matching nfs_client found\n", __func__); return status;
return -NFS4ERR_STALE_CLIENTID;
} }
#ifdef CONFIG_NFS_V4_1 #ifdef CONFIG_NFS_V4_1
@ -473,6 +471,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
if (!nfs4_match_serverowners(pos, new)) if (!nfs4_match_serverowners(pos, new))
continue; continue;
atomic_inc(&pos->cl_count);
spin_unlock(&nn->nfs_client_lock); spin_unlock(&nn->nfs_client_lock);
dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n", dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
__func__, pos, atomic_read(&pos->cl_count)); __func__, pos, atomic_read(&pos->cl_count));