From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andrew W Elble <aweits@rit.edu>,
Trond Myklebust <trond.myklebust@primarydata.com>,
"J. Bruce Fields" <bfields@redhat.com>
Subject: [PATCH 4.9 09/38] nfsd: Fix another OPEN stateid race
Date: Mon, 4 Dec 2017 16:59:49 +0100 [thread overview]
Message-ID: <20171204160007.817742588@linuxfoundation.org> (raw)
In-Reply-To: <20171204160007.448534903@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit d8a1a000555ecd1b824ac1ed6df8fe364dfbbbb0 upstream.
If nfsd4_process_open2() is initialising a new stateid, and yet the
call to nfs4_get_vfs_file() fails for some reason, then we must
declare the stateid closed, and unhash it before dropping the mutex.
Right now, we unhash the stateid after dropping the mutex, and without
changing the stateid type, meaning that another OPEN could theoretically
look it up and attempt to use it.
Reported-by: Andrew W Elble <aweits@rit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4453,6 +4453,7 @@ nfsd4_process_open2(struct svc_rqst *rqs
struct nfs4_ol_stateid *stp = NULL;
struct nfs4_delegation *dp = NULL;
__be32 status;
+ bool new_stp = false;
/*
* Lookup file; if found, lookup stateid and check open request,
@@ -4472,11 +4473,19 @@ nfsd4_process_open2(struct svc_rqst *rqs
goto out;
}
+ if (!stp) {
+ stp = init_open_stateid(fp, open);
+ if (!open->op_stp)
+ new_stp = true;
+ }
+
/*
* OPEN the file, or upgrade an existing OPEN.
* If truncate fails, the OPEN fails.
+ *
+ * stp is already locked.
*/
- if (stp) {
+ if (!new_stp) {
/* Stateid was found, this is an OPEN upgrade */
status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
if (status) {
@@ -4484,22 +4493,11 @@ nfsd4_process_open2(struct svc_rqst *rqs
goto out;
}
} else {
- /* stp is returned locked. */
- stp = init_open_stateid(fp, open);
- /* See if we lost the race to some other thread */
- if (stp->st_access_bmap != 0) {
- status = nfs4_upgrade_open(rqstp, fp, current_fh,
- stp, open);
- if (status) {
- mutex_unlock(&stp->st_mutex);
- goto out;
- }
- goto upgrade_out;
- }
status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
if (status) {
- mutex_unlock(&stp->st_mutex);
+ stp->st_stid.sc_type = NFS4_CLOSED_STID;
release_open_stateid(stp);
+ mutex_unlock(&stp->st_mutex);
goto out;
}
@@ -4508,7 +4506,7 @@ nfsd4_process_open2(struct svc_rqst *rqs
if (stp->st_clnt_odstate == open->op_odstate)
open->op_odstate = NULL;
}
-upgrade_out:
+
nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
mutex_unlock(&stp->st_mutex);
next prev parent reply other threads:[~2017-12-04 16:02 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-04 15:59 [PATCH 4.9 00/38] 4.9.67-stable review Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 01/38] ARM: dts: LogicPD Torpedo: Fix camera pin mux Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 02/38] ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 03/38] mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 04/38] mm/cma: fix alloc_contig_range ret code/potential leak Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 05/38] mm, hugetlbfs: introduce ->split() to vm_operations_struct Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 06/38] mm/madvise.c: fix madvise() infinite loop under special circumstances Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 07/38] btrfs: clear space cache inode generation always Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 08/38] nfsd: Fix stateid races between OPEN and CLOSE Greg Kroah-Hartman
2017-12-04 15:59 ` Greg Kroah-Hartman [this message]
2017-12-04 15:59 ` [PATCH 4.9 10/38] nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 11/38] mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 12/38] ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 16/38] KVM: lapic: Split out x2apic ldr calculation Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 17/38] KVM: lapic: Fixup LDR on load in x2apic Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 18/38] mmc: core: Do not leave the block driver in a suspended state Greg Kroah-Hartman
2017-12-04 15:59 ` [PATCH 4.9 19/38] mmc: core: prepend 0x to OCR entry in sysfs Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 20/38] eeprom: at24: fix reading from 24MAC402/24MAC602 Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 21/38] eeprom: at24: correctly set the size for at24mac402 Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 22/38] eeprom: at24: check at24_read/write arguments Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 23/38] i2c: i801: Fix Failed to allocate irq -2147483648 error Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 24/38] bcache: Fix building error on MIPS Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 25/38] hwmon: (jc42) optionally try to disable the SMBUS timeout Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 26/38] nvme-pci: add quirk for delay before CHK RDY for WDC SN200 Greg Kroah-Hartman
2017-12-04 16:42 ` Jeffrey Lien
2017-12-04 16:00 ` [PATCH 4.9 30/38] drm/radeon: fix atombios on big endian Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 31/38] drm/panel: simple: Add missing panel_simple_unprepare() calls Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 32/38] drm/hisilicon: Ensure LDI regs are properly configured Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 34/38] drm/amd/pp: fix typecast error in powerplay Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 35/38] Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()" Greg Kroah-Hartman
2017-12-04 16:00 ` [PATCH 4.9 36/38] NFS: revalidate "." etc correctly on "open" Greg Kroah-Hartman
2017-12-04 20:26 ` [PATCH 4.9 00/38] 4.9.67-stable review Shuah Khan
2017-12-04 23:46 ` Guenter Roeck
2017-12-05 7:09 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171204160007.817742588@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aweits@rit.edu \
--cc=bfields@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).