Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Attila Kovacs <attila.kovacs@cfa.harvard.edu>
To:     Libtirpc-devel Mailing List <libtirpc-devel@lists.sourceforge.net>
Cc:     Linux NFS Mailing list <linux-nfs@vger.kernel.org>
Subject: [PATCH] SUNRPC: mutexed access blacklist_read state variable.
Date:   Tue, 26 Jul 2022 16:12:43 -0400
Message-Id: <20220726201243.103800-1-attila.kovacs@cfa.harvard.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Attila Kovacs <attipaci@gmail.com>

bindresvport()_sa(), in bidresvport.c checks blacklist_read w/o mutex
before calling load_blacklist() which changes blacklist_read() also
unmutexed.

Clearly, the point is to read the blacklist only once on the first call,
but because the checking whether the blacklist is loaded is not mutexed,
more than one thread may race to load the blacklist concurrently, which
of course can jumble the list because of the race condition.

The fix simply moves the checking within the mutexed aread of the code
to eliminate the race condition.

---
 src/bindresvport.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/bindresvport.c b/src/bindresvport.c
index ef9b345..5c0ddcf 100644
--- a/src/bindresvport.c
+++ b/src/bindresvport.c
@@ -164,10 +164,11 @@ bindresvport_sa(sd, sa)
 	int endport = ENDPORT;
 	int i;
 
+	mutex_lock(&port_lock);
+
 	if (!blacklist_read)
 		load_blacklist();
 
-	mutex_lock(&port_lock);
 	nports = ENDPORT - startport + 1;
 
         if (sa == NULL) {
-- 
2.37.1