diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2014-03-03 04:03:12 +0100 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@primarydata.com> | 2014-03-03 04:03:12 +0100 |
| commit | 755a48a7a4eb05b9c8424e3017d947b2961a60e0 (patch) | |
| tree | 357da4eb493a7cf80df34af3bcceaab442614756 | |
| parent | NFSv4: Fix another nfs4_sequence corruptor (diff) | |
| download | linux-755a48a7a4eb05b9c8424e3017d947b2961a60e0.tar.xz linux-755a48a7a4eb05b9c8424e3017d947b2961a60e0.zip | |
NFS: Fix a delegation callback race
The clean-up in commit 36281caa839f ended up removing a NULL pointer check
that is needed in order to prevent an Oops in
nfs_async_inode_return_delegation().
Reported-by: "Yan, Zheng" <zheng.z.yan@intel.com>
Link: http://lkml.kernel.org/r/5313E9F6.2020405@intel.com
Fixes: 36281caa839f (NFSv4: Further clean-ups of delegation stateid validation)
Cc: stable@vger.kernel.org # 3.4+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
| -rw-r--r-- | fs/nfs/delegation.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c index ef792f29f831..5d8ccecf5f5c 100644 --- a/fs/nfs/delegation.c +++ b/fs/nfs/delegation.c @@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode, rcu_read_lock(); delegation = rcu_dereference(NFS_I(inode)->delegation); + if (delegation == NULL) + goto out_enoent; - if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) { - rcu_read_unlock(); - return -ENOENT; - } + if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) + goto out_enoent; nfs_mark_return_delegation(server, delegation); rcu_read_unlock(); nfs_delegation_run_state_manager(clp); return 0; +out_enoent: + rcu_read_unlock(); + return -ENOENT; } static struct inode * |