github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

lockd: pin next file across nlm_inspect_file lock-drop

Browse Source 
nlm_traverse_files() pins the current file with f_count++ across
a mutex_unlock for nlm_inspect_file(), but nothing pins the saved
next pointer.  A concurrent nlm_release_file() can kfree the next
file during the unlock window, and the iterator dereferences freed
memory on the next loop step.

Pin both current and next before the lock-drop.  Advance by
swapping the pinned cursors at the end of each iteration so next
is always held alive across the unlock.

Always call nlm_file_release() after dropping the iteration pin,
regardless of whether the file matched the predicate.  Use
nlm_file_inuse(), which does a live walk of the inode lock list,
rather than the cached f_locks field, so skipped files that never
ran nlm_inspect_file() are evaluated correctly.

Because every file in a hash bucket is now pinned and released,
files skipped by the is_failover_file predicate that have no
locks, blocks, shares, or external references are deleted during
traversal.  The old code never evaluated skipped files for
cleanup.  The new behavior is intentional: such files are stale
and should not persist in the table.

Fixes: 01df9c5e91 ("LOCKD: Fix a deadlock in nlm_traverse_files()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Michael Bommarito 2026-05-24 07:55:27 -04:00 committed by Chuck Lever
parent 6959297aaa
commit 526c49cff3
1 changed files with 30 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
fs/lockd/svcsubs.c
View File

@ -312,12 +312,10 @@ nlm_file_inuse(struct nlm_file *file)
return 0;
}
static void nlm_close_files(struct nlm_file *file)
static void nlm_file_release(struct nlm_file *file)
{
if (file->f_file[O_RDONLY])
nlmsvc_ops->fclose(file->f_file[O_RDONLY]);
if (file->f_file[O_WRONLY])
nlmsvc_ops->fclose(file->f_file[O_WRONLY]);
if (!nlm_file_inuse(file))
nlm_delete_file(file);
}
/*
@ -327,32 +325,41 @@ static int
nlm_traverse_files(void *data, nlm_host_match_fn_t match,
int (*is_failover_file)(void *data, struct nlm_file *file))
{
struct hlist_node *next;
struct nlm_file *file;
struct nlm_file *file, *next;
int i, ret = 0;
mutex_lock(&nlm_file_mutex);
for (i = 0; i < FILE_NRHASH; i++) {
hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) {
if (is_failover_file && !is_failover_file(data, file))
continue;
file = hlist_entry_safe(nlm_files[i].first,
struct nlm_file, f_list);
if (file)
file->f_count++;
mutex_unlock(&nlm_file_mutex);
while (file) {
/*
* Pin the next neighbour before we drop the mutex
* for nlm_inspect_file(); a concurrent
* nlm_release_file() under the same mutex would
* otherwise be free to unlink and kfree it during
* the unlock window, leaving us to dereference a
* freed slab when we walked to next afterwards.
*/
next = hlist_entry_safe(file->f_list.next,
struct nlm_file, f_list);
if (next)
next->f_count++;
/* Traverse locks, blocks and shares of this file
* and update file->f_locks count */
if (nlm_inspect_file(data, file, match))
ret = 1;
if (!is_failover_file || is_failover_file(data, file)) {
mutex_unlock(&nlm_file_mutex);
mutex_lock(&nlm_file_mutex);
file->f_count--;
/* No more references to this file. Let go of it. */
if (list_empty(&file->f_blocks) && !file->f_locks
&& !file->f_shares && !file->f_count) {
hlist_del(&file->f_list);
nlm_close_files(file);
kfree(file);
if (nlm_inspect_file(data, file, match))
ret = 1;
mutex_lock(&nlm_file_mutex);
}
file->f_count--;
nlm_file_release(file);
file = next;
}
}
mutex_unlock(&nlm_file_mutex);