mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 06:29:06 -04:00
Code Issues Packages Projects Releases Wiki Activity

NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh()

Browse Source 
In order for the wait in nfs_uuid_put() to be safe, it is necessary to
ensure that nfs_uuid_add_file() doesn't add a new entry once the
nfs_uuid->net has been NULLed out.

Also fix up the wake_up_var_locked() / wait_var_event_spinlock() to both
use the nfs_uuid address, since nfl, and &nfl->uuid could be used elsewhere.

Acked-by: Mike Snitzer <snitzer@kernel.org>
Tested-by: Mike Snitzer <snitzer@kernel.org>
Link: https://lore.kernel.org/all/175262893035.2234665.1735173020338594784@noble.neil.brown.name/
Fixes: 21fb440346 ("nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
Trond Myklebust
2025-07-15 12:49:00 -07:00
parent e144d53cf2
commit fdd015de76
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
fs/nfs_common/nfslocalio.c
View File

@@ -177,7 +177,7 @@ static bool nfs_uuid_put(nfs_uuid_t *nfs_uuid)
/* nfs_close_local_fh() is doing the /* nfs_close_local_fh() is doing the
* close and we must wait. until it unlinks * close and we must wait. until it unlinks
*/ */
wait_var_event_spinlock(nfl, wait_var_event_spinlock(nfs_uuid,
list_first_entry_or_null( list_first_entry_or_null(
&nfs_uuid->files, &nfs_uuid->files,
struct nfs_file_localio, struct nfs_file_localio,
@@ -243,15 +243,20 @@ void nfs_localio_invalidate_clients(struct list_head *nn_local_clients,
} }
EXPORT_SYMBOL_GPL(nfs_localio_invalidate_clients); EXPORT_SYMBOL_GPL(nfs_localio_invalidate_clients);
static void nfs_uuid_add_file(nfs_uuid_t *nfs_uuid, struct nfs_file_localio *nfl) static int nfs_uuid_add_file(nfs_uuid_t *nfs_uuid, struct nfs_file_localio *nfl)
{ {
int ret = 0;
/* Add nfl to nfs_uuid->files if it isn't already */ /* Add nfl to nfs_uuid->files if it isn't already */
spin_lock(&nfs_uuid->lock); spin_lock(&nfs_uuid->lock);
if (list_empty(&nfl->list)) { if (rcu_access_pointer(nfs_uuid->net) == NULL) {
ret = -ENXIO;
} else if (list_empty(&nfl->list)) {
rcu_assign_pointer(nfl->nfs_uuid, nfs_uuid); rcu_assign_pointer(nfl->nfs_uuid, nfs_uuid);
list_add_tail(&nfl->list, &nfs_uuid->files); list_add_tail(&nfl->list, &nfs_uuid->files);
} }
spin_unlock(&nfs_uuid->lock); spin_unlock(&nfs_uuid->lock);
return ret;
} }
/* /*
@@ -285,11 +290,13 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
} }
rcu_read_unlock(); rcu_read_unlock();
/* We have an implied reference to net thanks to nfsd_net_try_get */ /* We have an implied reference to net thanks to nfsd_net_try_get */
localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt, localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt, cred,
cred, nfs_fh, pnf, fmode); nfs_fh, pnf, fmode);
if (!IS_ERR(localio) && nfs_uuid_add_file(uuid, nfl) < 0) {
/* Delete the cached file when racing with nfs_uuid_put() */
nfs_to_nfsd_file_put_local(pnf);
}
nfs_to_nfsd_net_put(net); nfs_to_nfsd_net_put(net);
if (!IS_ERR(localio))
nfs_uuid_add_file(uuid, nfl);
return localio; return localio;
} }
@@ -338,7 +345,7 @@ void nfs_close_local_fh(struct nfs_file_localio *nfl)
*/ */
spin_lock(&nfs_uuid->lock); spin_lock(&nfs_uuid->lock);
list_del_init(&nfl->list); list_del_init(&nfl->list);
wake_up_var_locked(&nfl->nfs_uuid, &nfs_uuid->lock); wake_up_var_locked(nfs_uuid, &nfs_uuid->lock);
spin_unlock(&nfs_uuid->lock); spin_unlock(&nfs_uuid->lock);
} }
EXPORT_SYMBOL_GPL(nfs_close_local_fh); EXPORT_SYMBOL_GPL(nfs_close_local_fh);