diff options
| author | Trond Myklebust <trond.myklebust@primarydata.com> | 2016-08-28 06:44:04 +0300 |
|---|---|---|
| committer | Trond Myklebust <trond.myklebust@primarydata.com> | 2016-08-28 21:23:22 +0300 |
| commit | e09c978aae5bedfdb379be80363b024b7d82638b (patch) | |
| tree | d218fe2842cef66c0d33648f1f12163a61f70a62 /fs/nfs/callback_proc.c | |
| parent | 16590a228109e2f318d2cc6466221134cfab723a (diff) | |
| download | linux-e09c978aae5bedfdb379be80363b024b7d82638b.tar.xz | |
NFSv4.1: Fix Oopsable condition in server callback races
The slot table hasn't been an array since v3.7. Ensure that we
use nfs4_lookup_slot() to access the slot correctly.
Fixes: 87dda67e7386 ("NFSv4.1: Allow SEQUENCE to resize the slot table...")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: stable@vger.kernel.org # v3.8+
Diffstat (limited to 'fs/nfs/callback_proc.c')
| -rw-r--r-- | fs/nfs/callback_proc.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c index c92a75e066a6..a4cf6d2c14a4 100644 --- a/fs/nfs/callback_proc.c +++ b/fs/nfs/callback_proc.c @@ -454,11 +454,8 @@ static bool referring_call_exists(struct nfs_client *clp, ((u32 *)&rclist->rcl_sessionid.data)[3], ref->rc_sequenceid, ref->rc_slotid); - spin_lock(&tbl->slot_tbl_lock); - status = (test_bit(ref->rc_slotid, tbl->used_slots) && - tbl->slots[ref->rc_slotid].seq_nr == + status = nfs4_slot_seqid_in_use(tbl, ref->rc_slotid, ref->rc_sequenceid); - spin_unlock(&tbl->slot_tbl_lock); if (status) goto out; } |