nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock
authorChuck Lever <chuck.lever@oracle.com>
Wed, 13 Jul 2016 20:40:14 +0000 (16:40 -0400)
committerJ. Bruce Fields <bfields@redhat.com>
Fri, 15 Jul 2016 19:31:31 +0000 (15:31 -0400)
commit885848186fbc2d1d8fb6d2fdc2156638ae289a46
treee027bde79fc5704a6e462466d344336bd83b704b
parentdd51db188600c8c54c46cff84e83358ece8ccb4d
nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock

nfsd4_release_lockowner finds a lock owner that has no lock state,
and drops cl_lock. Then release_lockowner picks up cl_lock and
unhashes the lock owner.

During the window where cl_lock is dropped, I don't see anything
preventing a concurrent nfsd4_lock from finding that same lock owner
and adding lock state to it.

Move release_lockowner() into nfsd4_release_lockowner and hang onto
the cl_lock until after the lock owner's state cannot be found
again.

Found by inspection, we don't currently have a reproducer.

Fixes: 2c41beb0e5cf ("nfsd: reduce cl_lock thrashing in ... ")
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/nfs4state.c