提交 4b09ec4b 编写于 作者: B Benjamin Coddington 提交者: Trond Myklebust

nfs: Don't take a reference on fl->fl_file for LOCK operation

I have reports of a crash that look like __fput() was called twice for
a NFSv4.0 file.  It seems possible that the state manager could try to
reclaim a lock and take a reference on the fl->fl_file at the same time the
file is being released if, during the close(), a signal interrupts the wait
for outstanding IO while removing locks which then skips the removal
of that lock.

Since 83bfff23 ("nfs4: have do_vfs_lock take an inode pointer") has
removed the need to traverse fl->fl_file->f_inode in nfs4_lock_done(),
taking that reference is no longer necessary.
Signed-off-by: NBenjamin Coddington <bcodding@redhat.com>
Reviewed-by: NJeff Layton <jlayton@redhat.com>
Signed-off-by: NTrond Myklebust <trond.myklebust@primarydata.com>
上级 a121103c
...@@ -38,7 +38,6 @@ ...@@ -38,7 +38,6 @@
#include <linux/mm.h> #include <linux/mm.h>
#include <linux/delay.h> #include <linux/delay.h>
#include <linux/errno.h> #include <linux/errno.h>
#include <linux/file.h>
#include <linux/string.h> #include <linux/string.h>
#include <linux/ratelimit.h> #include <linux/ratelimit.h>
#include <linux/printk.h> #include <linux/printk.h>
...@@ -6127,7 +6126,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl, ...@@ -6127,7 +6126,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
p->server = server; p->server = server;
atomic_inc(&lsp->ls_count); atomic_inc(&lsp->ls_count);
p->ctx = get_nfs_open_context(ctx); p->ctx = get_nfs_open_context(ctx);
get_file(fl->fl_file);
memcpy(&p->fl, fl, sizeof(p->fl)); memcpy(&p->fl, fl, sizeof(p->fl));
return p; return p;
out_free_seqid: out_free_seqid:
...@@ -6240,7 +6238,6 @@ static void nfs4_lock_release(void *calldata) ...@@ -6240,7 +6238,6 @@ static void nfs4_lock_release(void *calldata)
nfs_free_seqid(data->arg.lock_seqid); nfs_free_seqid(data->arg.lock_seqid);
nfs4_put_lock_state(data->lsp); nfs4_put_lock_state(data->lsp);
put_nfs_open_context(data->ctx); put_nfs_open_context(data->ctx);
fput(data->fl.fl_file);
kfree(data); kfree(data);
dprintk("%s: done!\n", __func__); dprintk("%s: done!\n", __func__);
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册