| Message ID | 877ecv8zzf.fsf@notabene.neil.brown.name (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | NFS: fix mount/umount race in nlmclnt. | expand |
On Tue, 2019-03-19 at 11:33 +1100, NeilBrown wrote: > If the last NFSv3 unmount from a given host races with a mount from > the > same host, we can destroy an nlm_host that is still in use. > > Specifically nlmclnt_lookup_host() can increment h_count on > an nlm_host that nlmclnt_release_host() has just successfully called > refcount_dec_and_test() on. > Once nlmclnt_lookup_host() drops the mutex, nlm_destroy_host_lock() > will be called to destroy the nlmclnt which is now in use again. > > The cause of the problem is that the dec_and_test happens outside the > locked region. This is easily fixed by using > refcount_dec_and_mutex_lock(). > > Fixes: 8ea6ecc8b075 ("lockd: Create client-side nlm_host cache") > Cc: stable@vger.kernel.org (v2.6.38+) > Signed-off-by: NeilBrown <neilb@suse.com> > --- > fs/lockd/host.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/fs/lockd/host.c b/fs/lockd/host.c > index 93fb7cf0b92b..f0b5c987d6ae 100644 > --- a/fs/lockd/host.c > +++ b/fs/lockd/host.c > @@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host > *host) > > WARN_ON_ONCE(host->h_server); > > - if (refcount_dec_and_test(&host->h_count)) { > + if (refcount_dec_and_mutex_lock(&host->h_count, > &nlm_host_mutex)) { > WARN_ON_ONCE(!list_empty(&host->h_lockowners)); > WARN_ON_ONCE(!list_empty(&host->h_granted)); > WARN_ON_ONCE(!list_empty(&host->h_reclaim)); > > - mutex_lock(&nlm_host_mutex); > nlm_destroy_host_locked(host); > mutex_unlock(&nlm_host_mutex); > } Thanks Neil! Applying to linux-next.
diff --git a/fs/lockd/host.c b/fs/lockd/host.c index 93fb7cf0b92b..f0b5c987d6ae 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host *host) WARN_ON_ONCE(host->h_server); - if (refcount_dec_and_test(&host->h_count)) { + if (refcount_dec_and_mutex_lock(&host->h_count, &nlm_host_mutex)) { WARN_ON_ONCE(!list_empty(&host->h_lockowners)); WARN_ON_ONCE(!list_empty(&host->h_granted)); WARN_ON_ONCE(!list_empty(&host->h_reclaim)); - mutex_lock(&nlm_host_mutex); nlm_destroy_host_locked(host); mutex_unlock(&nlm_host_mutex); }
If the last NFSv3 unmount from a given host races with a mount from the same host, we can destroy an nlm_host that is still in use. Specifically nlmclnt_lookup_host() can increment h_count on an nlm_host that nlmclnt_release_host() has just successfully called refcount_dec_and_test() on. Once nlmclnt_lookup_host() drops the mutex, nlm_destroy_host_lock() will be called to destroy the nlmclnt which is now in use again. The cause of the problem is that the dec_and_test happens outside the locked region. This is easily fixed by using refcount_dec_and_mutex_lock(). Fixes: 8ea6ecc8b075 ("lockd: Create client-side nlm_host cache") Cc: stable@vger.kernel.org (v2.6.38+) Signed-off-by: NeilBrown <neilb@suse.com> --- fs/lockd/host.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)