The patch titled Fix locking in nsm_release has been added to the -mm tree. Its filename is knfsd-lockd-introduce-nsm_handle-fix.patch See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this ------------------------------------------------------ Subject: Fix locking in nsm_release From: Neil Brown <neilb@xxxxxxx> The locking is all backwards and broken. We first atomic_dec_and_test. If this fails, someone else has an active reference and we need do no more. If it succeeds, then the only ref is in the hash table, but someone might be about to find and use that reference. nsm_mutex provides exclusion against this. If sm_count is still 0 once the mutex has been gained, then it is safe to discard the nsm. Signed-off-by: Neil Brown <neilb@xxxxxxx> Cc: Olaf Kirch <okir@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxx> --- fs/lockd/host.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff -puN fs/lockd/host.c~knfsd-lockd-introduce-nsm_handle-fix fs/lockd/host.c --- a/fs/lockd/host.c~knfsd-lockd-introduce-nsm_handle-fix +++ a/fs/lockd/host.c @@ -483,9 +483,9 @@ nsm_release(struct nsm_handle *nsm) { if (!nsm) return; - if (atomic_read(&nsm->sm_count) == 1) { + if (atomic_dec_and_test(&nsm->sm_count)) { down(&nsm_sema); - if (atomic_dec_and_test(&nsm->sm_count)) { + if (atomic_read(&nsm->sm_count) == 0) { list_del(&nsm->sm_link); kfree(nsm); } _ Patches currently in -mm which might be from neilb@xxxxxxx are vfs-destroy-the-dentries-contributed-by-a-superblock-on-unmounting.patch knfsd-knfsd-add-some-missing-newlines-in-printks.patch knfsd-knfsd-remove-an-unused-variable-from-e_show.patch knfsd-knfsd-remove-an-unused-variable-from-auth_unix_lookup.patch knfsd-add-a-callback-for-when-last-rpc-thread-finishes.patch knfsd-add-a-callback-for-when-last-rpc-thread-finishes-tidy.patch knfsd-be-more-selective-in-which-sockets-lockd-listens-on.patch knfsd-remove-nfsd_versbits-as-intermediate-storage-for-desired-versions.patch knfsd-separate-out-some-parts-of-nfsd_svc-which-start-nfs-servers.patch knfsd-separate-out-some-parts-of-nfsd_svc-which-start-nfs-servers-tweaks.patch knfsd-define-new-nfsdfs-file-portlist-contains-list-of-ports.patch knfsd-define-new-nfsdfs-file-portlist-contains-list-of-ports-tidy.patch knfsd-define-new-nfsdfs-file-portlist-contains-list-of-ports-fix.patch knfsd-allow-sockets-to-be-passed-to-nfsd-via-portlist.patch knfsd-use-seq_start_token-instead-of-hardcoded-magic-void1.patch knfsd-have-ext2-reject-file-handles-with-bad-inode-numbers-early.patch knfsd-have-ext2-reject-file-handles-with-bad-inode-numbers-early-tidy.patch knfsd-make-ext3-reject-filehandles-referring-to-invalid-inode-numbers.patch knfsd-make-ext3-reject-filehandles-referring-to-invalid-inode-numbers-tidy.patch knfsd-drop-serv-option-to-svc_recv-and-svc_process.patch knfsd-drop-serv-option-to-svc_recv-and-svc_process-nfs-callback-fix-nfs-callback-fix.patch knfsd-check-return-value-of-lockd_up-in-write_ports.patch knfsd-move-makesock-failed-warning-into-make_socks.patch knfsd-correctly-handle-error-condition-from-lockd_up.patch knfsd-move-tempsock-aging-to-a-timer.patch knfsd-move-tempsock-aging-to-a-timer-tidy.patch knfsd-convert-sk_inuse-to-atomic_t.patch knfsd-use-new-lock-for-svc_sock-deferred-list.patch knfsd-convert-sk_reserved-to-atomic_t.patch knfsd-test-and-set-sk_busy-atomically.patch knfsd-split-svc_serv-into-pools.patch knfsd-split-svc_serv-into-pools-fix.patch knfsd-add-svc_get.patch knfsd-add-svc_set_num_threads.patch knfsd-use-svc_set_num_threads-to-manage-threads-in-knfsd.patch knfsd-make-rpc-threads-pools-numa-aware.patch knfsd-make-rpc-threads-pools-numa-aware-fix.patch knfsd-allow-admin-to-set-nthreads-per-node.patch nfsd-lockdep-annotation.patch knfsd-nfsd-lockdep-annotation-fix.patch knfsd-call-lockd_down-when-closing-a-socket-via-a-write-to-nfsd-portlist.patch knfsd-protect-update-to-sn_nrthreads-with-lock_kernel.patch knfsd-fixed-handling-of-lockd-fail-when-adding-nfsd-socket.patch knfsd-replace-two-page-lists-in-struct-svc_rqst-with-one.patch knfsd-avoid-excess-stack-usage-in-svc_tcp_recvfrom.patch knfsd-prepare-knfsd-for-support-of-rsize-wsize-of-up-to-1mb-over-tcp.patch knfsd-allow-max-size-of-nfsd-payload-to-be-configured.patch knfsd-make-nfsd-readahead-params-cache-smp-friendly.patch knfsd-knfsd-cache-ipmap-per-tcp-socket.patch knfsd-hide-use-of-lockds-h_monitored-flag.patch knfsd-consolidate-common-code-for-statd-lockd-notification.patch knfsd-when-looking-up-a-lockd-host-pass-hostname-length.patch knfsd-lockd-introduce-nsm_handle.patch knfsd-lockd-introduce-nsm_handle-fix.patch knfsd-misc-minor-fixes-indentation-changes.patch knfsd-lockd-make-nlm_host_rebooted-use-the-nsm_handle.patch knfsd-lockd-make-the-nsm-upcalls-use-the-nsm_handle.patch knfsd-lockd-make-the-hash-chains-use-a-hlist_node.patch knfsd-lockd-change-list-of-blocked-list-to-list_node.patch knfsd-change-nlm_file-to-use-a-hlist.patch knfsd-lockd-make-nlm_traverse_-more-flexible.patch knfsd-lockd-add-nlm_destroy_host.patch knfsd-simplify-nlmsvc_invalidate_all.patch knfsd-lockd-optionally-use-hostnames-for-identifying-peers.patch knfsd-make-nlmclnt_next_cookie-smp-safe.patch knfsd-match-granted_res-replies-using-cookies.patch knfsd-export-nsm_local_state-to-user-space-via-sysctl.patch knfsd-lockd-fix-use-of-h_nextrebind.patch knfsd-register-all-rpc-programs-with-portmapper-by-default.patch knfsd-lockd-introduce-nsm_handle-sem2mutex.patch md-the-scheduled-removal-of-the-start_array-ioctl-for-md.patch md-fix-a-comment-that-is-wrong-in-raid5h.patch md-factor-out-part-of-raid10d-into-a-separate-function.patch md-replace-magic-numbers-in-sb_dirty-with-well-defined-bit-flags.patch md-remove-the-working_disks-and-failed_disks-from-raid5-state-data.patch md-remove-working_disks-from-raid10-state.patch md-new-sysfs-interface-for-setting-bits-in-the-write-intent-bitmap.patch md-remove-unnecessary-variable-x-in-stripe_to_pdidx.patch md-factor-out-part-of-raid1d-into-a-separate-function.patch md-remove-working_disks-from-raid1-state-data.patch md-improve-locking-around-error-handling.patch md-define-backing_dev_infocongested_fn-for-raid0-and-linear.patch md-define-congested_fn-for-raid1-raid10-and-multipath.patch md-add-a-congested_fn-function-for-raid5-6.patch md-make-messages-about-resync-recovery-etc-more-specific.patch md-dm-reduce-stack-usage-with-stacked-block-devices.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html