Commit 5870963f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux 

Pull nfsd fixes from Chuck Lever:

 - Fix NFSD bring-up / shutdown

 - Fix a UAF when releasing a stateid

* tag 'nfsd-6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  nfsd: fix possible badness in FREE_STATEID
  nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net() failed
  NFSD: Mark filecache "down" if init fails
parents 825ec756 c88c150a

fs/nfsd/filecache.c

+3 −1
Original line number Diff line number Diff line
@@ -751,7 +751,7 @@ nfsd_file_cache_init(void) 


	ret = rhltable_init(&nfsd_file_rhltable, &nfsd_file_rhash_params);

	if (ret)

		return ret;

		goto out;



	ret = -ENOMEM;

	nfsd_file_slab = KMEM_CACHE(nfsd_file, 0);
@@ -803,6 +803,8 @@ nfsd_file_cache_init(void) 


	INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker);

out:

	if (ret)

		clear_bit(NFSD_FILE_CACHE_UP, &nfsd_file_flags);

	return ret;

out_notifier:

	lease_unregister_notifier(&nfsd_file_lease_notifier);

fs/nfsd/nfs4state.c

+1 −0
Original line number Diff line number Diff line
@@ -7154,6 +7154,7 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, 
	switch (s->sc_type) {

	case SC_TYPE_DELEG:

		if (s->sc_status & SC_STATUS_REVOKED) {

			s->sc_status |= SC_STATUS_CLOSED;

			spin_unlock(&s->sc_lock);

			dp = delegstateid(s);

			list_del_init(&dp->dl_recall_lru);

fs/nfsd/nfssvc.c

+3 −3
Original line number Diff line number Diff line
@@ -434,6 +434,9 @@ static void nfsd_shutdown_net(struct net *net) 
{

	struct nfsd_net *nn = net_generic(net, nfsd_net_id);



	if (!nn->nfsd_net_up)

		return;

	nfsd_export_flush(net);

	nfs4_state_shutdown_net(net);

	nfsd_reply_cache_shutdown(nn);

	nfsd_file_cache_shutdown_net(net);
@@ -549,11 +552,8 @@ void nfsd_destroy_serv(struct net *net) 
	 * other initialization has been done except the rpcb information.

	 */

	svc_rpcb_cleanup(serv, net);

	if (!nn->nfsd_net_up)

		return;



	nfsd_shutdown_net(net);

	nfsd_export_flush(net);

	svc_destroy(&serv);

}