nfsd: fix potential race in nfs4_find_file

The WARN_ON_ONCE check is not terribly useful. It also seems possible
for nfs4_find_file to race with the destruction of an fi_deleg_file
while trying to take a reference to it.

Now that it's safe to pass nfs_get_file a NULL pointer, remove the WARN
and NULL pointer check. Take the fi_lock when fetching fi_deleg_file.

Cc: NeilBrown <neilb@suse.de>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9657dab980cb55018371be2a36cbcf1051f37d0b..7ed7239945910daf671dcdbadf34c4461029abc6 100644 (file)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6404,23 +6404,26 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
 static struct nfsd_file *
 nfs4_find_file(struct nfs4_stid *s, int flags)
 {
+       struct nfsd_file *ret = NULL;
+
        if (!s)
                return NULL;
 
        switch (s->sc_type) {
        case NFS4_DELEG_STID:
-               if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
-                       return NULL;
-               return nfsd_file_get(s->sc_file->fi_deleg_file);
+               spin_lock(&s->sc_file->fi_lock);
+               ret = nfsd_file_get(s->sc_file->fi_deleg_file);
+               spin_unlock(&s->sc_file->fi_lock);
+               break;
        case NFS4_OPEN_STID:
        case NFS4_LOCK_STID:
                if (flags & RD_STATE)
-                       return find_readable_file(s->sc_file);
+                       ret = find_readable_file(s->sc_file);
                else
-                       return find_writeable_file(s->sc_file);
+                       ret = find_writeable_file(s->sc_file);
        }
 
-       return NULL;
+       return ret;
 }
 
 static __be32