Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sasha Levin <Alexander.Levin@microsoft.com>
To:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
CC:     Trond Myklebust <trond.myklebust@primarydata.com>,
        "J . Bruce Fields" <bfields@redhat.com>,
        Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 4.14 057/100] nfsd: Ensure we don't recognise lock
 stateids after freeing them
Thread-Topic: [PATCH AUTOSEL for 4.14 057/100] nfsd: Ensure we don't recognise
 lock stateids after freeing them
Thread-Index: AQHTlMni0FqA8X0CD0ukthGE9IUuUw==
Date:   Wed, 24 Jan 2018 04:14:53 +0000
Message-ID: <20180124041414.32065-57-alexander.levin@microsoft.com>
References: <20180124041414.32065-1-alexander.levin@microsoft.com>
In-Reply-To: <20180124041414.32065-1-alexander.levin@microsoft.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: dde3e91a-b9f4-4b8c-1ba7-08d562e11545
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jan 2018 04:14:53.6395
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB1015
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Trond Myklebust <trond.myklebust@primarydata.com>

[ Upstream commit 659aefb68eca28ba9aa482a9fc64de107332e256 ]

In order to deal with lookup races, nfsd4_free_lock_stateid() needs
to be able to signal to other stateful functions that the lock stateid
is no longer valid. Right now, nfsd_lock() will check whether or not an
existing stateid is still hashed, but only in the "new lock" path.

To ensure the stateid invalidation is also recognised by the "existing lock=
"
path, and also by a second call to nfsd4_free_lock_stateid() itself, we can
change the type to NFS4_CLOSED_STID under the stp->st_mutex.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 fs/nfsd/nfs4state.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 61f38346ce9d..5ec0ca5cbc1e 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5099,7 +5099,9 @@ nfsd4_free_lock_stateid(stateid_t *stateid, struct nf=
s4_stid *s)
 	struct nfs4_ol_stateid *stp =3D openlockstateid(s);
 	__be32 ret;
=20
-	mutex_lock(&stp->st_mutex);
+	ret =3D nfsd4_lock_ol_stateid(stp);
+	if (ret)
+		goto out_put_stid;
=20
 	ret =3D check_stateid_generation(stateid, &s->sc_stateid, 1);
 	if (ret)
@@ -5110,11 +5112,13 @@ nfsd4_free_lock_stateid(stateid_t *stateid, struct =
nfs4_stid *s)
 			    lockowner(stp->st_stateowner)))
 		goto out;
=20
+	stp->st_stid.sc_type =3D NFS4_CLOSED_STID;
 	release_lock_stateid(stp);
 	ret =3D nfs_ok;
=20
 out:
 	mutex_unlock(&stp->st_mutex);
+out_put_stid:
 	nfs4_put_stid(s);
 	return ret;
 }
@@ -5683,6 +5687,8 @@ find_lock_stateid(struct nfs4_lockowner *lo, struct n=
fs4_file *fp)
 	lockdep_assert_held(&clp->cl_lock);
=20
 	list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
+		if (lst->st_stid.sc_type !=3D NFS4_LOCK_STID)
+			continue;
 		if (lst->st_stid.sc_file =3D=3D fp) {
 			atomic_inc(&lst->st_stid.sc_count);
 			return lst;
@@ -5757,7 +5763,6 @@ lookup_or_create_lock_state(struct nfsd4_compound_sta=
te *cstate,
 	struct nfs4_lockowner *lo;
 	struct nfs4_ol_stateid *lst;
 	unsigned int strhashval;
-	bool hashed;
=20
 	lo =3D find_lockowner_str(cl, &lock->lk_new_owner);
 	if (!lo) {
@@ -5780,15 +5785,7 @@ retry:
 		goto out;
 	}
=20
-	mutex_lock(&lst->st_mutex);
-
-	/* See if it's still hashed to avoid race with FREE_STATEID */
-	spin_lock(&cl->cl_lock);
-	hashed =3D !list_empty(&lst->st_perfile);
-	spin_unlock(&cl->cl_lock);
-
-	if (!hashed) {
-		mutex_unlock(&lst->st_mutex);
+	if (nfsd4_lock_ol_stateid(lst) !=3D nfs_ok) {
 		nfs4_put_stid(&lst->st_stid);
 		goto retry;
 	}
--=20
2.11.0