projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 95244f99 GKH |
1 | From foo@baz Wed Dec 6 17:39:55 CET 2017 |
| 2 | From: Benjamin Coddington <bcodding@redhat.com> | |
| 3 | Date: Thu, 5 Jan 2017 10:20:16 -0500 | |
| 4 | Subject: nfs: Don't take a reference on fl->fl_file for LOCK operation | |
| 5 | ||
| 6 | From: Benjamin Coddington <bcodding@redhat.com> | |
| 7 | ||
| 8 | ||
| 9 | [ Upstream commit 4b09ec4b14a168bf2c687e1f598140c3c11e9222 ] | |
| 10 | ||
| 11 | I have reports of a crash that look like __fput() was called twice for | |
| 12 | a NFSv4.0 file. It seems possible that the state manager could try to | |
| 13 | reclaim a lock and take a reference on the fl->fl_file at the same time the | |
| 14 | file is being released if, during the close(), a signal interrupts the wait | |
| 15 | for outstanding IO while removing locks which then skips the removal | |
| 16 | of that lock. | |
| 17 | ||
| 18 | Since 83bfff23e9ed ("nfs4: have do_vfs_lock take an inode pointer") has | |
| 19 | removed the need to traverse fl->fl_file->f_inode in nfs4_lock_done(), | |
| 20 | taking that reference is no longer necessary. | |
| 21 | ||
| 22 | Signed-off-by: Benjamin Coddington <bcodding@redhat.com> | |
| 23 | Reviewed-by: Jeff Layton <jlayton@redhat.com> | |
| 24 | Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> | |
| 25 | Signed-off-by: Sasha Levin <alexander.levin@verizon.com> | |
| 26 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 27 | --- | |
| 28 | fs/nfs/nfs4proc.c | 3 --- | |
| 29 | 1 file changed, 3 deletions(-) | |
| 30 | ||
| 31 | --- a/fs/nfs/nfs4proc.c | |
| 32 | +++ b/fs/nfs/nfs4proc.c | |
| 33 | @@ -38,7 +38,6 @@ | |
| 34 | #include <linux/mm.h> | |
| 35 | #include <linux/delay.h> | |
| 36 | #include <linux/errno.h> | |
| 37 | -#include <linux/file.h> | |
| 38 | #include <linux/string.h> | |
| 39 | #include <linux/ratelimit.h> | |
| 40 | #include <linux/printk.h> | |
| 41 | @@ -6006,7 +6005,6 @@ static struct nfs4_lockdata *nfs4_alloc_ | |
| 42 | p->server = server; | |
| 43 | atomic_inc(&lsp->ls_count); | |
| 44 | p->ctx = get_nfs_open_context(ctx); | |
| 45 | - get_file(fl->fl_file); | |
| 46 | memcpy(&p->fl, fl, sizeof(p->fl)); | |
| 47 | return p; | |
| 48 | out_free_seqid: | |
| 49 | @@ -6119,7 +6117,6 @@ static void nfs4_lock_release(void *call | |
| 50 | nfs_free_seqid(data->arg.lock_seqid); | |
| 51 | nfs4_put_lock_state(data->lsp); | |
| 52 | put_nfs_open_context(data->ctx); | |
| 53 | - fput(data->fl.fl_file); | |
| 54 | kfree(data); | |
| 55 | dprintk("%s: done!\n", __func__); | |
| 56 | } |