[lkml]   [2013]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 014/106] lockd: protect nlm_blocked access in nlmsvc_retry_blocked
Date -stable review patch.  If anyone has any objections, please let me know.


From: David Jeffery <>

commit 1c327d962fc420aea046c16215a552710bde8231 upstream.

In nlmsvc_retry_blocked, the check that the list is non-empty and acquiring
the pointer of the first entry is unprotected by any lock. This allows a rare
race condition when there is only one entry on the list. A function such as
nlmsvc_grant_callback() can be called, which will temporarily remove the entry
from the list. Between the list_empty() and list_entry(),the list may become
empty, causing an invalid pointer to be used as an nlm_block, leading to a
possible crash.

This patch adds the nlm_block_lock around these calls to prevent concurrent
use of the nlm_blocked list.

This was a regression introduced by
f904be9cc77f361d37d71468b13ff3d1a1823dea "lockd: Mostly remove BKL from
the server".

Cc: Bryan Schumaker <>
Signed-off-by: David Jeffery <>
Signed-off-by: J. Bruce Fields <>
Signed-off-by: Luis Henriques <>
fs/lockd/svclock.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index e46353f..aff1c61 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -941,6 +941,7 @@ nlmsvc_retry_blocked(void)
unsigned long timeout = MAX_SCHEDULE_TIMEOUT;
struct nlm_block *block;

+ spin_lock(&nlm_blocked_lock);
while (!list_empty(&nlm_blocked) && !kthread_should_stop()) {
block = list_entry(, struct nlm_block, b_list);

@@ -950,6 +951,7 @@ nlmsvc_retry_blocked(void)
timeout = block->b_when - jiffies;
+ spin_unlock(&nlm_blocked_lock);

dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
block, block->b_when);
@@ -959,7 +961,9 @@ nlmsvc_retry_blocked(void)
} else
+ spin_lock(&nlm_blocked_lock);
+ spin_unlock(&nlm_blocked_lock);

return timeout;

 \ /
  Last update: 2013-07-30 11:41    [W:0.200 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site