Commit 64e63041 authored by Jeff Layton's avatar Jeff Layton Committed by Chuck Lever
Browse files

nfsd: drop the nfsd_put helper 



It's not safe to call nfsd_put once nfsd_last_thread has been called, as
that function will zero out the nn->nfsd_serv pointer.

Drop the nfsd_put helper altogether and open-code the svc_put in its
callers instead. That allows us to not be reliant on the value of that
pointer when handling an error.

Fixes: 2a501f55 ("nfsd: call nfsd_last_thread() before final nfsd_put()")
Reported-by: default avatarZhi Li <yieli@redhat.com>
Cc: NeilBrown <neilb@suse.de>
Signed-off-by: default avatarJeffrey Layton <jlayton@redhat.com>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent bd018b98

fs/nfsd/nfsctl.c

+17 −14
Original line number Diff line number Diff line
@@ -693,6 +693,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred 
	char *mesg = buf;

	int fd, err;

	struct nfsd_net *nn = net_generic(net, nfsd_net_id);

	struct svc_serv *serv;



	err = get_int(&mesg, &fd);

	if (err != 0 || fd < 0)
@@ -703,15 +704,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred 
	if (err != 0)

		return err;



	err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);

	serv = nn->nfsd_serv;

	err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);



	if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active)

	if (err < 0 && !serv->sv_nrthreads && !nn->keep_active)

		nfsd_last_thread(net);

	else if (err >= 0 &&

		 !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))

		svc_get(nn->nfsd_serv);

	else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1))

		svc_get(serv);



	nfsd_put(net);

	svc_put(serv);

	return err;

}
@@ -725,6 +726,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr 
	struct svc_xprt *xprt;

	int port, err;

	struct nfsd_net *nn = net_generic(net, nfsd_net_id);

	struct svc_serv *serv;



	if (sscanf(buf, "%15s %5u", transport, &port) != 2)

		return -EINVAL;
@@ -737,32 +739,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr 
	if (err != 0)

		return err;



	err = svc_xprt_create(nn->nfsd_serv, transport, net,

	serv = nn->nfsd_serv;

	err = svc_xprt_create(serv, transport, net,

			      PF_INET, port, SVC_SOCK_ANONYMOUS, cred);

	if (err < 0)

		goto out_err;



	err = svc_xprt_create(nn->nfsd_serv, transport, net,

	err = svc_xprt_create(serv, transport, net,

			      PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);

	if (err < 0 && err != -EAFNOSUPPORT)

		goto out_close;



	if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))

		svc_get(nn->nfsd_serv);

	if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1))

		svc_get(serv);



	nfsd_put(net);

	svc_put(serv);

	return 0;

out_close:

	xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port);

	xprt = svc_find_xprt(serv, transport, net, PF_INET, port);

	if (xprt != NULL) {

		svc_xprt_close(xprt);

		svc_xprt_put(xprt);

	}

out_err:

	if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active)

	if (!serv->sv_nrthreads && !nn->keep_active)

		nfsd_last_thread(net);



	nfsd_put(net);

	svc_put(serv);

	return err;

}

fs/nfsd/nfsd.h

+0 −7
Original line number Diff line number Diff line
@@ -113,13 +113,6 @@ int nfsd_pool_stats_open(struct inode *, struct file *); 
int		nfsd_pool_stats_release(struct inode *, struct file *);

void		nfsd_shutdown_threads(struct net *net);



static inline void nfsd_put(struct net *net)

{

	struct nfsd_net *nn = net_generic(net, nfsd_net_id);



	svc_put(nn->nfsd_serv);

}



bool		i_am_nfsd(void);



struct nfsdfs_client {