mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 10:40:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

svcrpc: fix list-corrupting race on nfsd shutdown

Browse source 
After commit 3262c816a3 "[PATCH] knfsd:
split svc_serv into pools", svc_delete_xprt (then svc_delete_socket) no
longer removed its xpt_ready (then sk_ready) field from whatever list it
was on, noting that there was no point since the whole list was about to
be destroyed anyway.

That was mostly true, but forgot that a few svc_xprt_enqueue()'s might
still be hanging around playing with the about-to-be-destroyed list, and
could get themselves into trouble writing to freed memory if we left
this xprt on the list after freeing it.

(This is actually functionally identical to a patch made first by Ben
Greear, but with more comments.)

Cc: stable@kernel.org
Cc: gnb@fmeh.org
Reported-by: Ben Greear <greearb@candelatech.com>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
J. Bruce Fields 2011-06-29 16:49:04 -04:00
parent 058c5c9999
commit ebc63e531c
1 changed files with 6 additions and 5 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

11
net/sunrpc/svc_xprt.c
View file

@ -902,12 +902,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags)) if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
list_del_init(&xprt->xpt_list); list_del_init(&xprt->xpt_list);
/* /*
* We used to delete the transport from whichever list * The only time we're called while xpt_ready is still on a list
* it's sk_xprt.xpt_ready node was on, but we don't actually * is while the list itself is about to be destroyed (in
* need to. This is because the only time we're called * svc_destroy). BUT svc_xprt_enqueue could still be attempting
* while still attached to a queue, the queue itself * to add new entries to the sp_sockets list, so we can't leave
* is about to be destroyed (in svc_destroy). * a freed xprt on it.
*/ */
list_del_init(&xprt->xpt_ready);
if (test_bit(XPT_TEMP, &xprt->xpt_flags)) if (test_bit(XPT_TEMP, &xprt->xpt_flags))
serv->sv_tmpcnt--; serv->sv_tmpcnt--;
spin_unlock_bh(&serv->sv_lock); spin_unlock_bh(&serv->sv_lock);