Commit bd6aaf78 authored by Jeff Layton's avatar Jeff Layton Committed by Chuck Lever
Browse files

nfsd: fix potential race in nfs4_find_file 



The WARN_ON_ONCE check is not terribly useful. It also seems possible
for nfs4_find_file to race with the destruction of an fi_deleg_file
while trying to take a reference to it.

Now that it's safe to pass nfs_get_file a NULL pointer, remove the WARN
and NULL pointer check. Take the fi_lock when fetching fi_deleg_file.

Cc: NeilBrown <neilb@suse.de>
Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 70f62231

fs/nfsd/nfs4state.c

+9 −6
Original line number Diff line number Diff line
@@ -6404,23 +6404,26 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, 
static struct nfsd_file *

nfs4_find_file(struct nfs4_stid *s, int flags)

{

	struct nfsd_file *ret = NULL;



	if (!s)

		return NULL;



	switch (s->sc_type) {

	case NFS4_DELEG_STID:

		if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))

			return NULL;

		return nfsd_file_get(s->sc_file->fi_deleg_file);

		spin_lock(&s->sc_file->fi_lock);

		ret = nfsd_file_get(s->sc_file->fi_deleg_file);

		spin_unlock(&s->sc_file->fi_lock);

		break;

	case NFS4_OPEN_STID:

	case NFS4_LOCK_STID:

		if (flags & RD_STATE)

			return find_readable_file(s->sc_file);

			ret = find_readable_file(s->sc_file);

		else

			return find_writeable_file(s->sc_file);

			ret = find_writeable_file(s->sc_file);

	}



	return NULL;

	return ret;

}



static __be32