NFS/localio: Fix a race in nfs_local_open_fh()

Once the clp->cl_uuid.lock has been dropped, another CPU could come in
and free the struct nfsd_file that was just added. To prevent that from
happening, take the RCU read lock before dropping the spin lock.

Fixes: 86e00412254a ("nfs: cache all open LOCALIO nfsd_file(s) in client")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Mike Snitzer <snitzer@kernel.org>

diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 5c21caeae075c7fc5f3a56be2f0e21b33e2ded00..4ec952f9f47dde1c5277dc4f6df9848a633df011 100644 (file)
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -278,6 +278,7 @@ nfs_local_open_fh(struct nfs_client *clp, const struct cred *cred,
                new = __nfs_local_open_fh(clp, cred, fh, nfl, mode);
                if (IS_ERR(new))
                        return NULL;
+               rcu_read_lock();
                /* try to swap in the pointer */
                spin_lock(&clp->cl_uuid.lock);
                nf = rcu_dereference_protected(*pnf, 1);
@@ -287,7 +288,6 @@ nfs_local_open_fh(struct nfs_client *clp, const struct cred *cred,
                        rcu_assign_pointer(*pnf, nf);
                }
                spin_unlock(&clp->cl_uuid.lock);
-               rcu_read_lock();
        }
        nf = nfs_local_file_get(nf);
        rcu_read_unlock();