From: Jeff Layton Date: Thu, 10 Jul 2014 18:07:33 +0000 (-0400) Subject: nfsd: always hold the fi_lock when bumping fi_access refcounts X-Git-Tag: omap-for-v3.17/fixes-against-rc2~101^2~115 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7214e8600eee146b6ea79eb6b7b01b343856a7c6;p=pandora-kernel.git nfsd: always hold the fi_lock when bumping fi_access refcounts Once we remove the client_mutex, there's an unlikely but possible race that could occur. It will be possible for nfs4_file_put_access to race with nfs4_file_get_access. The refcount will go to zero (briefly) and then bumped back to one. If that happens we set ourselves up for a use-after-free and the potential for a lock to race onto the i_flock list as a filp is being torn down. Ensure that we can safely bump the refcount on the file by holding the fi_lock whenever that's done. The only place it currently isn't is in get_lock_access. In order to ensure atomicity with finding the file, use the find_*_file_locked variants and then call get_lock_access to get new access references on the nfs4_file under the same lock. Signed-off-by: Jeff Layton Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields --- Reading git-diff-tree failed