]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 28 Mar 2022 12:36:34 +0000 (08:36 -0400)
committerStefan Bader <stefan.bader@canonical.com>
Wed, 27 Apr 2022 09:58:18 +0000 (11:58 +0200)
commit4c04da75b69b914464e804cf3519f6fd32a352e2
tree729807ebe3d75da2bb34e1ed382df232fe299b38
parentfdac8356dfd6125121abaad8dd3e63e885c6ef75
NFSv4/pNFS: Fix another issue with a list iterator pointing to the head

BugLink: https://bugs.launchpad.net/bugs/1969110
[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ]

In nfs4_callback_devicenotify(), if we don't find a matching entry for
the deviceid, we're left with a pointer to 'struct nfs_server' that
actually points to the list of super blocks associated with our struct
nfs_client.
Furthermore, even if we have a valid pointer, nothing pins the super
block, and so the struct nfs_server could end up getting freed while
we're using it.

Since all we want is a pointer to the struct pnfs_layoutdriver_type,
let's skip all the iteration over super blocks, and just use APIs to
find the layout driver directly.

Reported-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit a738ff8143d89abccfeb458d07a9d559ade7f1a1)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
fs/nfs/callback_proc.c
fs/nfs/pnfs.c
fs/nfs/pnfs.h