Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Attila Kovacs <attila.kovacs@cfa.harvard.edu>
To:     Libtirpc-devel Mailing List <libtirpc-devel@lists.sourceforge.net>
Cc:     Linux NFS Mailing list <linux-nfs@vger.kernel.org>
Subject: [PATCH 1/2] clnt_dg_freeres() uncleared set active state may deadlock.
Date:   Mon, 25 Jul 2022 12:06:45 -0400
Message-Id: <20220725160646.15610-1-attila.kovacs@cfa.harvard.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Attila Kovacs <attipaci@gmail.com>

In clnt_dg.c in clnt_dg_freeres(), cu_fd_lock->active is set to TRUE, with no 
corresponding clearing when the operation (*xdr_res() call) is completed. This 
would leave other waiting operations blocked indefinitely, effectively 
deadlocking the client. For comparison, clnt_vd_freeres() in clnt_vc.c does not
set the active state to TRUE. I believe the vc behavior is correct, while the 
dg behavior is a bug. 

Signed-off-by: Attila Kovacs <attipaci@gmail.com>
---
 src/clnt_dg.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/clnt_dg.c b/src/clnt_dg.c
index 7c5d22e..b2043ac 100644
--- a/src/clnt_dg.c
+++ b/src/clnt_dg.c
@@ -573,7 +573,6 @@ clnt_dg_freeres(cl, xdr_res, res_ptr)
 	mutex_lock(&clnt_fd_lock);
 	while (cu->cu_fd_lock->active)
 		cond_wait(&cu->cu_fd_lock->cv, &clnt_fd_lock);
-	cu->cu_fd_lock->active = TRUE;
 	xdrs->x_op = XDR_FREE;
 	dummy = (*xdr_res)(xdrs, res_ptr);
 	thr_sigsetmask(SIG_SETMASK, &mask, NULL);
-- 
2.37.1