• NeilBrown's avatar
    NFS: fix mount/umount race in nlmclnt. · e37c15d7
    NeilBrown authored
    commit 4a9be28c upstream.
    
    If the last NFSv3 unmount from a given host races with a mount from the
    same host, we can destroy an nlm_host that is still in use.
    
    Specifically nlmclnt_lookup_host() can increment h_count on
    an nlm_host that nlmclnt_release_host() has just successfully called
    refcount_dec_and_test() on.
    Once nlmclnt_lookup_host() drops the mutex, nlm_destroy_host_lock()
    will be called to destroy the nlmclnt which is now in use again.
    
    The cause of the problem is that the dec_and_test happens outside the
    locked region.  This is easily fixed by using
    refcount_dec_and_mutex_lock().
    
    Fixes: 8ea6ecc8 ("lockd: Create client-side nlm_host cache")
    Cc: stable@vger.kernel.org (v2.6.38+)
    Signed-off-by: 's avatarNeilBrown <neilb@suse.com>
    Signed-off-by: 's avatarTrond Myklebust <trond.myklebust@hammerspace.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    e37c15d7
Name
Last commit
Last update
..
Makefile Loading commit data...
clnt4xdr.c Loading commit data...
clntlock.c Loading commit data...
clntproc.c Loading commit data...
clntxdr.c Loading commit data...
host.c Loading commit data...
mon.c Loading commit data...
netns.h Loading commit data...
procfs.c Loading commit data...
procfs.h Loading commit data...
svc.c Loading commit data...
svc4proc.c Loading commit data...
svclock.c Loading commit data...
svcproc.c Loading commit data...
svcshare.c Loading commit data...
svcsubs.c Loading commit data...
xdr.c Loading commit data...
xdr4.c Loading commit data...