nfsd4: fix destroy_session race
[deliverable/linux.git] / fs / nfsd / nfs4state.c
index 2e27430b9070fc6ca71a56432409b85f465f5d0a..8cc668dc4997fb9cf22da80ef369fba7cb897adc 100644 (file)
@@ -761,8 +761,8 @@ static void nfsd4_conn_lost(struct svc_xpt_user *u)
                list_del(&c->cn_persession);
                free_conn(c);
        }
-       spin_unlock(&clp->cl_lock);
        nfsd4_probe_callback(clp);
+       spin_unlock(&clp->cl_lock);
 }
 
 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
@@ -864,7 +864,7 @@ static void free_session(struct kref *kref)
        __free_session(ses);
 }
 
-void nfsd4_put_session(struct nfsd4_session *ses)
+static void nfsd4_put_session(struct nfsd4_session *ses)
 {
        struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
 
@@ -1057,12 +1057,16 @@ release_session_client(struct nfsd4_session *session)
        struct nfs4_client *clp = session->se_client;
        struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 
+       nfsd4_put_session(session);
        if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
                return;
-       if (is_client_expired(clp)) {
+       /*
+        * At this point we also know all sessions have refcnt 1,
+        * so free_client will delete them all if necessary:
+        */
+       if (is_client_expired(clp))
                free_client(clp);
-               session->se_client = NULL;
-       } else
+       else
                renew_client_locked(clp);
        spin_unlock(&nn->client_lock);
 }
@@ -1376,12 +1380,12 @@ move_to_confirmed(struct nfs4_client *clp)
 }
 
 static struct nfs4_client *
-find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
+find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
 {
        struct nfs4_client *clp;
        unsigned int idhashval = clientid_hashval(clid->cl_id);
 
-       list_for_each_entry(clp, &nn->conf_id_hashtbl[idhashval], cl_idhash) {
+       list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
                if (same_clid(&clp->cl_clientid, clid)) {
                        if ((bool)clp->cl_minorversion != sessions)
                                return NULL;
@@ -1392,20 +1396,20 @@ find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
        return NULL;
 }
 
+static struct nfs4_client *
+find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
+{
+       struct list_head *tbl = nn->conf_id_hashtbl;
+
+       return find_client_in_id_table(tbl, clid, sessions);
+}
+
 static struct nfs4_client *
 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
 {
-       struct nfs4_client *clp;
-       unsigned int idhashval = clientid_hashval(clid->cl_id);
+       struct list_head *tbl = nn->unconf_id_hashtbl;
 
-       list_for_each_entry(clp, &nn->unconf_id_hashtbl[idhashval], cl_idhash) {
-               if (same_clid(&clp->cl_clientid, clid)) {
-                       if ((bool)clp->cl_minorversion != sessions)
-                               return NULL;
-                       return clp;
-               }
-       }
-       return NULL;
+       return find_client_in_id_table(tbl, clid, sessions);
 }
 
 static bool clp_used_exchangeid(struct nfs4_client *clp)
@@ -1784,6 +1788,7 @@ nfsd4_create_session(struct svc_rqst *rqstp,
        nfs4_lock_state();
        unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
        conf = find_confirmed_client(&cr_ses->clientid, true, nn);
+       WARN_ON_ONCE(conf && unconf);
 
        if (conf) {
                cs_slot = &conf->cl_cs_slot;
@@ -1838,15 +1843,13 @@ nfsd4_create_session(struct svc_rqst *rqstp,
        /* cache solo and embedded create sessions under the state lock */
        nfsd4_cache_create_session(cr_ses, cs_slot, status);
        nfs4_unlock_state();
-out:
-       dprintk("%s returns %d\n", __func__, ntohl(status));
        return status;
 out_free_conn:
        nfs4_unlock_state();
        free_conn(conn);
 out_free_session:
        __free_session(new);
-       goto out;
+       return status;
 }
 
 static __be32 nfsd4_map_bcts_dir(u32 *dir)
@@ -1923,42 +1926,35 @@ nfsd4_destroy_session(struct svc_rqst *r,
                      struct nfsd4_destroy_session *sessionid)
 {
        struct nfsd4_session *ses;
-       __be32 status = nfserr_badsession;
+       __be32 status;
        struct nfsd_net *nn = net_generic(SVC_NET(r), nfsd_net_id);
 
-       /* Notes:
-        * - The confirmed nfs4_client->cl_sessionid holds destroyed sessinid
-        * - Should we return nfserr_back_chan_busy if waiting for
-        *   callbacks on to-be-destroyed session?
-        * - Do we need to clear any callback info from previous session?
-        */
-
+       nfs4_lock_state();
+       status = nfserr_not_only_op;
        if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
                if (!nfsd4_last_compound_op(r))
-                       return nfserr_not_only_op;
+                       goto out;
        }
        dump_sessionid(__func__, &sessionid->sessionid);
        spin_lock(&nn->client_lock);
        ses = find_in_sessionid_hashtbl(&sessionid->sessionid, SVC_NET(r));
-       if (!ses) {
-               spin_unlock(&nn->client_lock);
-               goto out;
-       }
+       status = nfserr_badsession;
+       if (!ses)
+               goto out_client_lock;
 
        unhash_session(ses);
        spin_unlock(&nn->client_lock);
 
-       nfs4_lock_state();
        nfsd4_probe_callback_sync(ses->se_client);
-       nfs4_unlock_state();
 
        spin_lock(&nn->client_lock);
        nfsd4_del_conns(ses);
        nfsd4_put_session_locked(ses);
-       spin_unlock(&nn->client_lock);
        status = nfs_ok;
+out_client_lock:
+       spin_unlock(&nn->client_lock);
 out:
-       dprintk("%s returns %d\n", __func__, ntohl(status));
+       nfs4_unlock_state();
        return status;
 }
 
@@ -2111,7 +2107,6 @@ out:
        }
        kfree(conn);
        spin_unlock(&nn->client_lock);
-       dprintk("%s: return %d\n", __func__, ntohl(status));
        return status;
 }
 
@@ -2125,17 +2120,12 @@ nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *csta
        nfs4_lock_state();
        unconf = find_unconfirmed_client(&dc->clientid, true, nn);
        conf = find_confirmed_client(&dc->clientid, true, nn);
+       WARN_ON_ONCE(conf && unconf);
 
        if (conf) {
                clp = conf;
 
-               if (!is_client_expired(conf) && client_has_state(conf)) {
-                       status = nfserr_clientid_busy;
-                       goto out;
-               }
-
-               /* rfc5661 18.50.3 */
-               if (cstate->session && conf == cstate->session->se_client) {
+               if (client_has_state(conf)) {
                        status = nfserr_clientid_busy;
                        goto out;
                }
@@ -2149,7 +2139,6 @@ nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *csta
        expire_client(clp);
 out:
        nfs4_unlock_state();
-       dprintk("%s return %d\n", __func__, ntohl(status));
        return status;
 }
 
@@ -2526,8 +2515,6 @@ nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
        struct nfs4_ol_stateid *stp;
        __be32 ret;
 
-       dprintk("NFSD: nfs4_share_conflict\n");
-
        fp = find_file(ino);
        if (!fp)
                return nfs_ok;
@@ -3276,16 +3263,6 @@ static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *s
        return nfs_ok;
 }
 
-static int
-STALE_STATEID(stateid_t *stateid, struct nfsd_net *nn)
-{
-       if (stateid->si_opaque.so_clid.cl_boot == nn->boot_time)
-               return 0;
-       dprintk("NFSD: stale stateid " STATEID_FMT "!\n",
-               STATEID_VAL(stateid));
-       return 1;
-}
-
 static inline int
 access_permit_read(struct nfs4_ol_stateid *stp)
 {
@@ -3416,19 +3393,20 @@ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask,
                                   struct nfsd_net *nn)
 {
        struct nfs4_client *cl;
+       __be32 status;
 
        if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
                return nfserr_bad_stateid;
-       if (STALE_STATEID(stateid, nn))
+       status = lookup_clientid(&stateid->si_opaque.so_clid, sessions,
+                                                       nn, &cl);
+       if (status == nfserr_stale_clientid)
                return nfserr_stale_stateid;
-       cl = find_confirmed_client(&stateid->si_opaque.so_clid, sessions, nn);
-       if (!cl)
-               return nfserr_expired;
+       if (status)
+               return status;
        *s = find_stateid_by_type(cl, stateid, typemask);
        if (!*s)
                return nfserr_bad_stateid;
        return nfs_ok;
-
 }
 
 /*
@@ -3819,6 +3797,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
        nfsd4_close_open_stateid(stp);
        release_last_closed_stateid(oo);
+       oo->oo_flags &= ~NFS4_OO_PURGE_CLOSE;
        oo->oo_last_closed_stid = stp;
 
        if (list_empty(&oo->oo_owner.so_stateids)) {
This page took 0.037299 seconds and 5 git commands to generate.