Commit 40927f3d authored by NeilBrown's avatar NeilBrown Committed by Chuck Lever
Browse files

nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease 



It is not safe to dereference fl->c.flc_owner without first confirming
fl->fl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()
tests fl_lmops but largely ignores the result and assumes that flc_owner
is an nfs4_delegation anyway.  This is wrong.

With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave
as it did before the change mentioned below.  This is the same as the
current code, but without any reference to a possible delegation.

Fixes: c5967721 ("NFSD: handle GETATTR conflict with write delegation")
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 7e8ae848

fs/nfsd/nfs4state.c

+9 −2
Original line number Diff line number Diff line
@@ -8859,7 +8859,15 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry, 
			 */

			if (type == F_RDLCK)

				break;

			goto break_lease;



			nfsd_stats_wdeleg_getattr_inc(nn);

			spin_unlock(&ctx->flc_lock);



			status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));

			if (status != nfserr_jukebox ||

			    !nfsd_wait_for_delegreturn(rqstp, inode))

				return status;

			return 0;

		}

		if (type == F_WRLCK) {

			struct nfs4_delegation *dp = fl->c.flc_owner;
@@ -8868,7 +8876,6 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry, 
				spin_unlock(&ctx->flc_lock);

				return 0;

			}

break_lease:

			nfsd_stats_wdeleg_getattr_inc(nn);

			dp = fl->c.flc_owner;

			refcount_inc(&dp->dl_stid.sc_count);