In _pnfs_return_layout:
lrp pointer is checked for NULL after it was already accessed.
The rational here is that in _pnfs_return_layout we want to
de-ref and release the layout regardless of if we sent the
return or not (forgetfull). An eventual recall can return -ENOMATCHING
instead of -EDELAY.
So to keep the reasoning above, copy the stateid twice.
Benny if it is OK to not release the layout on -ENOMEM then the check
could just be moved above the spin_lock(), and the put_layout_hdr removed.
Signed-off-by: Boaz Harrosh <bharrosh@xxxxxxxxxxx>
---
fs/nfs/pnfs.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index a07b007..c3ec577 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -628,6 +628,7 @@ _pnfs_return_layout(struct inode *ino)
struct nfs_inode *nfsi = NFS_I(ino);
LIST_HEAD(tmp_list);
struct nfs4_layoutreturn *lrp;
+ nfs4_stateid stateid;
int status = 0;
dprintk("--> %s\n", __func__);
@@ -642,7 +643,7 @@ _pnfs_return_layout(struct inode *ino)
kfree(lrp);
goto out;
}
- lrp->args.stateid = nfsi->layout->plh_stateid;
+ stateid = nfsi->layout->plh_stateid;
/* Reference matched in nfs4_layoutreturn_release */
get_layout_hdr(lo);
spin_unlock(&ino->i_lock);
@@ -655,6 +656,7 @@ _pnfs_return_layout(struct inode *ino)
status = -ENOMEM;
goto out;
}
+ lrp->args.stateid = stateid;
lrp->args.reclaim = 0;
lrp->args.layout_type = NFS_SERVER(ino)->pnfs_curr_ld->id;
lrp->args.inode = ino;
--
1.7.2.3
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
