Two nfsd bugfixes are available in the for-2.6.37 branch at:
git://linux-nfs.org/~bfields/linux.git for-2.6.37
Huh--Neil needs to decide whether or not there's a space in his name.
--b.
Neil Brown (1):
nfsd: Fix possible BUG_ON firing in set_change_info
NeilBrown (1):
sunrpc: prevent use-after-free on clearing XPT_BUSY
fs/nfsd/nfs3xdr.c | 6 ++++--
fs/nfsd/xdr4.h | 21 ++++++++++-----------
net/sunrpc/svc_xprt.c | 9 ++++++++-
3 files changed, 22 insertions(+), 14 deletions(-)
commit c1ac3ffcd0bc7e9617f62be8c7043d53ab84deac
Author: Neil Brown <neilb@xxxxxxx>
Date: Thu Dec 2 11:14:30 2010 +1100
nfsd: Fix possible BUG_ON firing in set_change_info
If vfs_getattr in fill_post_wcc returns an error, we don't
set fh_post_change.
For NFSv4, this can result in set_change_info triggering a BUG_ON.
i.e. fh_post_saved being zero isn't really a bug.
So:
- instead of BUGging when fh_post_saved is zero, just clear ->atomic.
- if vfs_getattr fails in fill_post_wcc, take a copy of i_ctime anyway.
This will be used i seg_change_info, but not overly trusted.
- While we are there, remove the pointless 'if' statements in set_change_info.
There is no harm setting all the values.
Signed-off-by: NeilBrown <neilb@xxxxxxx>
Cc: stable@xxxxxxxxxx
Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxx>
commit ed2849d3ecfa339435818eeff28f6c3424300cec
Author: NeilBrown <neilb@xxxxxxx>
Date: Tue Nov 16 16:55:19 2010 +1100
sunrpc: prevent use-after-free on clearing XPT_BUSY
When an xprt is created, it has a refcount of 1, and XPT_BUSY is set.
The refcount is *not* owned by the thread that created the xprt
(as is clear from the fact that creators never put the reference).
Rather, it is owned by the absence of XPT_DEAD. Once XPT_DEAD is set,
(And XPT_BUSY is clear) that initial reference is dropped and the xprt
can be freed.
So when a creator clears XPT_BUSY it is dropping its only reference and
so must not touch the xprt again.
However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY
reference on a new xprt), calls svc_xprt_recieved. This clears
XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.
This is dangerous and has been seen to leave svc_xprt_enqueue working
with an xprt containing garbage.
So we need to hold an extra counted reference over that call to
svc_xprt_received.
For safety, any time we clear XPT_BUSY and then use the xprt again, we
first get a reference, and the put it again afterwards.
Note that svc_close_all does not need this extra protection as there are
no threads running, and the final free can only be called asynchronously
from such a thread.
Signed-off-by: NeilBrown <neilb@xxxxxxx>
Cc: stable@xxxxxxxxxx
Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
