Unverified Commit bd81eb39 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5485 nfsd: fix use-after-free due to delegation race 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5K7LBT6L442VSYUU7P5A5KQ4VUCNLGFI/ 
 
https://gitee.com/openeuler/kernel/issues/I99EU2 
 
Link:https://gitee.com/openeuler/kernel/pulls/5485

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 42a67bc7 b9fdf086

fs/nfsd/nfs4state.c

+7 −2
Original line number Diff line number Diff line
@@ -971,6 +971,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) 
	return 0;

}



static bool delegation_hashed(struct nfs4_delegation *dp)

{

	return !(list_empty(&dp->dl_perfile));

}



static bool

unhash_delegation_locked(struct nfs4_delegation *dp)

{
@@ -978,7 +983,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) 


	lockdep_assert_held(&state_lock);



	if (list_empty(&dp->dl_perfile))

	if (!delegation_hashed(dp))

		return false;



	dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
@@ -3901,7 +3906,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) 
	 * queued for a lease break. Don't queue it again.

	 */

	spin_lock(&state_lock);

	if (dp->dl_time == 0) {

	if (delegation_hashed(dp) && dp->dl_time == 0) {

		dp->dl_time = get_seconds();

		list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);

	}