lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NFSv4/pNFS: Fix another issue with a list iterator pointing to the head

Browse Source 
[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ]

In nfs4_callback_devicenotify(), if we don't find a matching entry for
the deviceid, we're left with a pointer to 'struct nfs_server' that
actually points to the list of super blocks associated with our struct
nfs_client.
Furthermore, even if we have a valid pointer, nothing pins the super
block, and so the struct nfs_server could end up getting freed while
we're using it.

Since all we want is a pointer to the struct pnfs_layoutdriver_type,
let's skip all the iteration over super blocks, and just use APIs to
find the layout driver directly.

Reported-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Fixes: 1be5683b03 ("pnfs: CB_NOTIFY_DEVICEID")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Trond Myklebust 2022-03-28 08:36:34 -04:00 committed by Greg Kroah-Hartman
parent 9acf05b4e7
commit 910a98e5c1
3 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
fs/nfs/callback_proc.c
View File

@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
struct cb_process_state *cps) struct cb_process_state *cps)
{ {
struct cb_devicenotifyargs *args = argp; struct cb_devicenotifyargs *args = argp;
const struct pnfs_layoutdriver_type *ld = NULL;
uint32_t i; uint32_t i;
__be32 res = 0; __be32 res = 0;
struct nfs_client *clp = cps->clp;
struct nfs_server *server = NULL;
if (!clp) { if (!cps->clp) {
res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION);
goto out; goto out;
} }
@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
for (i = 0; i < args->ndevs; i++) { for (i = 0; i < args->ndevs; i++) {
struct cb_devicenotifyitem *dev = &args->devs[i]; struct cb_devicenotifyitem *dev = &args->devs[i];
if (!server || if (!ld || ld->id != dev->cbd_layout_type) {
server->pnfs_curr_ld->id != dev->cbd_layout_type) { pnfs_put_layoutdriver(ld);
rcu_read_lock(); ld = pnfs_find_layoutdriver(dev->cbd_layout_type);
list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) if (!ld)
if (server->pnfs_curr_ld && continue;
server->pnfs_curr_ld->id == dev->cbd_layout_type) {
rcu_read_unlock();
goto found;
}
rcu_read_unlock();
continue;
} }
nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id);
found:
nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id);
} }
pnfs_put_layoutdriver(ld);
out: out:
kfree(args->devs); kfree(args->devs);
return res; return res;

11
fs/nfs/pnfs.c
View File

@ -92,6 +92,17 @@ find_pnfs_driver(u32 id)
return local; return local;
} }
const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id)
{
return find_pnfs_driver(id);
}
void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld)
{
if (ld)
module_put(ld->owner);
}
void void
unset_pnfs_layoutdriver(struct nfs_server *nfss) unset_pnfs_layoutdriver(struct nfs_server *nfss)
{ {

2
fs/nfs/pnfs.h
View File

@ -226,6 +226,8 @@ struct pnfs_devicelist {
extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *);
extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *);
extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id);
extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld);
/* nfs4proc.c */ /* nfs4proc.c */
extern size_t max_response_pages(struct nfs_server *server); extern size_t max_response_pages(struct nfs_server *server);