NFS: Fix put_nfs_open_context

We need to grab the inode->i_lock atomically with the last reference put in
order to remove the open context that is being freed from the
nfsi->open_files list.

Fix by converting the kref to a standard atomic counter and then using
atomic_dec_and_lock()...

Thanks to Arnd Bergmann for pointing out the problem.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index bca6cdcb9f0dd738a4bb5f6d07d0b27f5a72c3a2..71a49c3acabdb26d941fb5fea5ce41e23e72ff2b 100644 (file)
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -468,7 +468,7 @@ static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, str
                ctx->lockowner = current->files;
                ctx->error = 0;
                ctx->dir_cookie = 0;
-               kref_init(&ctx->kref);
+               atomic_set(&ctx->count, 1);
        }
        return ctx;
 }
@@ -476,21 +476,18 @@ static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, str
 struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx)
 {
        if (ctx != NULL)
-               kref_get(&ctx->kref);
+               atomic_inc(&ctx->count);
        return ctx;
 }
 
-static void nfs_free_open_context(struct kref *kref)
+void put_nfs_open_context(struct nfs_open_context *ctx)
 {
-       struct nfs_open_context *ctx = container_of(kref,
-                       struct nfs_open_context, kref);
+       struct inode *inode = ctx->path.dentry->d_inode;
 
-       if (!list_empty(&ctx->list)) {
-               struct inode *inode = ctx->path.dentry->d_inode;
-               spin_lock(&inode->i_lock);
-               list_del(&ctx->list);
-               spin_unlock(&inode->i_lock);
-       }
+       if (!atomic_dec_and_lock(&ctx->count, &inode->i_lock))
+               return;
+       list_del(&ctx->list);
+       spin_unlock(&inode->i_lock);
        if (ctx->state != NULL)
                nfs4_close_state(&ctx->path, ctx->state, ctx->mode);
        if (ctx->cred != NULL)
@@ -500,11 +497,6 @@ static void nfs_free_open_context(struct kref *kref)
        kfree(ctx);
 }
 
-void put_nfs_open_context(struct nfs_open_context *ctx)
-{
-       kref_put(&ctx->kref, nfs_free_open_context);
-}
-
 /*
  * Ensure that mmap has a recent RPC credential for use when writing out
  * shared pages

diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 9ba4aec37c5060a081e1bda1c670ac80463cbae8..157dcb055b5ca499bff63580e8f64921f2b85e67 100644 (file)
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -71,7 +71,7 @@ struct nfs_access_entry {
 
 struct nfs4_state;
 struct nfs_open_context {
-       struct kref kref;
+       atomic_t count;
        struct path path;
        struct rpc_cred *cred;
        struct nfs4_state *state;