nfsd: drop the nfsd_put helper

commit 64e6304169f1e1f078e7f0798033f80a7fb0ea46 upstream.

It's not safe to call nfsd_put once nfsd_last_thread has been called, as
that function will zero out the nn->nfsd_serv pointer.

Drop the nfsd_put helper altogether and open-code the svc_put in its
callers instead. That allows us to not be reliant on the value of that
pointer when handling an error.

Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()")
Reported-by: Zhi Li <yieli@redhat.com>
Cc: NeilBrown <neilb@suse.de>
Signed-off-by: Jeffrey Layton <jlayton@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 98854dd..a13e81e 100644 (file)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -692,6 +692,7 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred
        char *mesg = buf;
        int fd, err;
        struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+       struct svc_serv *serv;
 
        err = get_int(&mesg, &fd);
        if (err != 0 || fd < 0)
@@ -702,15 +703,15 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred
        if (err != 0)
                return err;
 
-       err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
+       serv = nn->nfsd_serv;
+       err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
 
-       if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
+       if (err < 0 && !serv->sv_nrthreads && !nn->keep_active)
                nfsd_last_thread(net);
-       else if (err >= 0 &&
-                !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
-               svc_get(nn->nfsd_serv);
+       else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
+               svc_get(serv);
 
-       nfsd_put(net);
+       svc_put(serv);
        return err;
 }
 
@@ -724,6 +725,7 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr
        struct svc_xprt *xprt;
        int port, err;
        struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+       struct svc_serv *serv;
 
        if (sscanf(buf, "%15s %5u", transport, &port) != 2)
                return -EINVAL;
@@ -736,32 +738,33 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr
        if (err != 0)
                return err;
 
-       err = svc_xprt_create(nn->nfsd_serv, transport, net,
+       serv = nn->nfsd_serv;
+       err = svc_xprt_create(serv, transport, net,
                              PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
        if (err < 0)
                goto out_err;
 
-       err = svc_xprt_create(nn->nfsd_serv, transport, net,
+       err = svc_xprt_create(serv, transport, net,
                              PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
        if (err < 0 && err != -EAFNOSUPPORT)
                goto out_close;
 
-       if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
-               svc_get(nn->nfsd_serv);
+       if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
+               svc_get(serv);
 
-       nfsd_put(net);
+       svc_put(serv);
        return 0;
 out_close:
-       xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port);
+       xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
        if (xprt != NULL) {
                svc_xprt_close(xprt);
                svc_xprt_put(xprt);
        }
 out_err:
-       if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
+       if (!serv->sv_nrthreads && !nn->keep_active)
                nfsd_last_thread(net);
 
-       nfsd_put(net);
+       svc_put(serv);
        return err;
 }
 

diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 63deed2..fe846a3 100644 (file)
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -96,13 +96,6 @@ int          nfsd_pool_stats_open(struct inode *, struct file *);
 int            nfsd_pool_stats_release(struct inode *, struct file *);
 void           nfsd_shutdown_threads(struct net *net);
 
-static inline void nfsd_put(struct net *net)
-{
-       struct nfsd_net *nn = net_generic(net, nfsd_net_id);
-
-       svc_put(nn->nfsd_serv);
-}
-
 bool           i_am_nfsd(void);
 
 struct nfsdfs_client {