Commit a204501e authored by Olga Kornievskaia's avatar Olga Kornievskaia Committed by Chuck Lever
Browse files

nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open 



Prior to commit 3f29cc82 ("nfsd: split sc_status out of
sc_type") states_show() relied on sc_type field to be of valid
type before calling into a subfunction to show content of a
particular stateid. From that commit, we split the validity of
the stateid into sc_status and no longer changed sc_type to 0
while unhashing the stateid. This resulted in kernel oopsing
for nfsv4.0 opens that stay around and in nfs4_show_open()
would derefence sc_file which was NULL.

Instead, for closed open stateids forgo displaying information
that relies of having a valid sc_file.

To reproduce: mount the server with 4.0, read and close
a file and then on the server cat /proc/fs/nfsd/clients/2/states

[  513.590804] Call trace:
[  513.590925]  _raw_spin_lock+0xcc/0x160
[  513.591119]  nfs4_show_open+0x78/0x2c0 [nfsd]
[  513.591412]  states_show+0x44c/0x488 [nfsd]
[  513.591681]  seq_read_iter+0x5d8/0x760
[  513.591896]  seq_read+0x188/0x208
[  513.592075]  vfs_read+0x148/0x470
[  513.592241]  ksys_read+0xcc/0x178

Fixes: 3f29cc82 ("nfsd: split sc_status out of sc_type")
Signed-off-by: default avatarOlga Kornievskaia <okorniev@redhat.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent f58bab6f

fs/nfsd/nfs4state.c

+12 −9
Original line number Diff line number Diff line
@@ -2789,6 +2789,7 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st) 
		deny & NFS4_SHARE_ACCESS_READ ? "r" : "-",

		deny & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");



	if (nf) {

		spin_lock(&nf->fi_lock);

		file = find_any_file_locked(nf);

		if (file) {
@@ -2798,6 +2799,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st) 
			seq_puts(s, ", ");

		}

		spin_unlock(&nf->fi_lock);

	} else

		seq_puts(s, "closed, ");

	nfs4_show_owner(s, oo);

	if (st->sc_status & SC_STATUS_ADMIN_REVOKED)

		seq_puts(s, ", admin-revoked");