summaryrefslogtreecommitdiff
path: root/fs/lockd/svcsubs.c
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2022-01-19 01:00:16 +0300
committerChuck Lever <chuck.lever@oracle.com>2022-01-19 01:07:48 +0300
commit6e7f90d163afa8fc2efd6ae318e7c20156a5621f (patch)
tree64a68ce96fc5a09496ae50fd6e02f526393bd8f2 /fs/lockd/svcsubs.c
parent16720861675393a35974532b3c837d9fd7bfe08c (diff)
downloadlinux-6e7f90d163afa8fc2efd6ae318e7c20156a5621f.tar.xz
lockd: fix server crash on reboot of client holding lock
I thought I was iterating over the array when actually the iteration is over the values contained in the array? Ugh, keep it simple. Symptoms were a null deference in vfs_lock_file() when an NFSv3 client that previously held a lock came back up and sent a notify. Reported-by: Jonathan Woithe <jwoithe@just42.net> Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Diffstat (limited to 'fs/lockd/svcsubs.c')
-rw-r--r--fs/lockd/svcsubs.c17
1 files changed, 9 insertions, 8 deletions
diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c
index cb3a7512c33e..54c2e42130ca 100644
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -179,19 +179,20 @@ nlm_delete_file(struct nlm_file *file)
static int nlm_unlock_files(struct nlm_file *file)
{
struct file_lock lock;
- struct file *f;
lock.fl_type = F_UNLCK;
lock.fl_start = 0;
lock.fl_end = OFFSET_MAX;
- for (f = file->f_file[0]; f <= file->f_file[1]; f++) {
- if (f && vfs_lock_file(f, F_SETLK, &lock, NULL) < 0) {
- pr_warn("lockd: unlock failure in %s:%d\n",
- __FILE__, __LINE__);
- return 1;
- }
- }
+ if (file->f_file[O_RDONLY] &&
+ vfs_lock_file(file->f_file[O_RDONLY], F_SETLK, &lock, NULL))
+ goto out_err;
+ if (file->f_file[O_WRONLY] &&
+ vfs_lock_file(file->f_file[O_WRONLY], F_SETLK, &lock, NULL))
+ goto out_err;
return 0;
+out_err:
+ pr_warn("lockd: unlock failure in %s:%d\n", __FILE__, __LINE__);
+ return 1;
}
/*