From patchwork Wed Jul 19 22:09:39 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Trond Myklebust X-Patchwork-Id: 9853263 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 32084602BD for ; Wed, 19 Jul 2017 22:10:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 240AA28700 for ; Wed, 19 Jul 2017 22:10:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 17C4D28717; Wed, 19 Jul 2017 22:10:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A9CCA28700 for ; Wed, 19 Jul 2017 22:10:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754577AbdGSWKH (ORCPT ); Wed, 19 Jul 2017 18:10:07 -0400 Received: from mail-it0-f68.google.com ([209.85.214.68]:34520 "EHLO mail-it0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753904AbdGSWKG (ORCPT ); Wed, 19 Jul 2017 18:10:06 -0400 Received: by mail-it0-f68.google.com with SMTP id o202so858077itc.1 for ; Wed, 19 Jul 2017 15:10:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:subject:date:message-id:in-reply-to:references; bh=2ui2MEpws9mVEN1NLAzO9lyCEANK8LlJ03mSsaGAmkk=; b=XeQMOp2jhUVjeX4zfSjIgAsdKBriXebBEk1vKI+SdyMKZSNAxWfjD2UsZgQyS/RK0j GSkq9qJHTWMkM9rd0h9hG/6jLXBoOQ3z4yIjqi3PlneDHHYGRMzVgpraywFSh4G4nQsi uYIex0yldAEYVoUd3mZonPqOrcsF66seCMjEqykQANYfslqzZZn9obuuUA47niMegHgg g1zN01XEIfg+/dmzXHdevE0sSD4/l3okJpPE+/REQmO7aJDWj4spoA4g4ZaiizSEec2B j4UeSWV9clGQJrt8enxZWnaNGatIz78MGKihDhFuliE2uMgTNJ/CsRRSLnAycTVEV8A2 x6eA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:subject:date:message-id :in-reply-to:references; bh=2ui2MEpws9mVEN1NLAzO9lyCEANK8LlJ03mSsaGAmkk=; b=TiZqLZ/N1cdwLeLopmZkszAjEmwyR/CnzdoW9OUZOGTxEfs3so0QVyarLi97j+RVTa sfEXU1flb+Rfw/tI8es8b7HFVF1Aw7cAXy3qEuwpv8h3UcBXyyWUzEFYDUc6OBSTyvfs EWV3bnXJ9M6UajS0hOe1s8Mdk+qaiXBBrNB1q7yuX3b2TLJqTFk69pRi3ED/Pxys8x/j z1Y0r9UagG2pJyPL414J2BSIfPQGbmkobv4OZGVcqpwl8IWL0pWniH+0uvr94Kyv7J4k DYYqsvV0hW3c89wUut1J5oiSk6g76JGlRbQS4TAkzyigFEqc/LJfoEVGMHXxwd7u7Eh9 GRjA== X-Gm-Message-State: AIVw113lTRvJLUlq9eytah28xHl8ULUDisJbBaZktGU7AwVzLzvql+Ft ngLNX+Xh1ziLaiw+Vv0= X-Received: by 10.36.54.77 with SMTP id l74mr1446741itl.148.1500502206230; Wed, 19 Jul 2017 15:10:06 -0700 (PDT) Received: from leira.trondhjem.org (c-68-49-162-121.hsd1.mi.comcast.net. [68.49.162.121]) by smtp.gmail.com with ESMTPSA id 9sm518333iop.9.2017.07.19.15.10.04 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 19 Jul 2017 15:10:04 -0700 (PDT) From: Trond Myklebust To: Chuck Lever , linux-nfs@vger.kernel.org Subject: [PATCH 04/20] NFS: Ensure we always dereference the page head last Date: Wed, 19 Jul 2017 18:09:39 -0400 Message-Id: <20170719220955.58210-5-trond.myklebust@primarydata.com> X-Mailer: git-send-email 2.13.3 In-Reply-To: <20170719220955.58210-4-trond.myklebust@primarydata.com> References: <20170719220955.58210-1-trond.myklebust@primarydata.com> <20170719220955.58210-2-trond.myklebust@primarydata.com> <20170719220955.58210-3-trond.myklebust@primarydata.com> <20170719220955.58210-4-trond.myklebust@primarydata.com> Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This fixes a race with nfs_page_group_sync_on_bit() whereby the call to wake_up_bit() in nfs_page_group_unlock() could occur after the page header had been freed. Signed-off-by: Trond Myklebust --- fs/nfs/pagelist.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c index de9066a92c0d..a6f2bbd709ba 100644 --- a/fs/nfs/pagelist.c +++ b/fs/nfs/pagelist.c @@ -306,14 +306,11 @@ static void nfs_page_group_destroy(struct kref *kref) { struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref); + struct nfs_page *head = req->wb_head; struct nfs_page *tmp, *next; - /* subrequests must release the ref on the head request */ - if (req->wb_head != req) - nfs_release_request(req->wb_head); - if (!nfs_page_group_sync_on_bit(req, PG_TEARDOWN)) - return; + goto out; tmp = req; do { @@ -324,6 +321,10 @@ nfs_page_group_destroy(struct kref *kref) nfs_free_request(tmp); tmp = next; } while (tmp != req); +out: + /* subrequests must release the ref on the head request */ + if (head != req) + nfs_release_request(head); } /**