nfsd4: fix delegation recall race use-after-free
authorJ. Bruce Fields <bfields@citi.umich.edu>
Tue, 1 Jun 2010 15:21:40 +0000 (11:21 -0400)
committerJ. Bruce Fields <bfields@citi.umich.edu>
Thu, 24 Jun 2010 16:24:55 +0000 (12:24 -0400)
When the rarely-used callback-connection-changing setclientid occurs
simultaneously with a delegation recall, we rerun the recall by
requeueing it on a workqueue.  But we also need to take a reference on
the delegation in that case, since the delegation held by the rpc itself
will be released by the rpc_release callback.

Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
fs/nfsd/nfs4callback.c

index a4686326b5aef4b538088dd7973246e9307aa55c..1e6497ed3e1219c4db2abcf07f0c380ab4b4007a 100644 (file)
@@ -689,6 +689,7 @@ static void nfsd4_cb_recall_done(struct rpc_task *task, void *calldata)
                warn_no_callback_path(clp, task->tk_status);
                if (current_rpc_client != task->tk_client) {
                        /* queue a callback on the new connection: */
+                       atomic_inc(&dp->dl_count);
                        nfsd4_cb_recall(dp);
                        return;
                }