Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 18 Sep 2020 23:52:56 +0000 (UTC)
From:      Rick Macklem <rmacklem@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r365895 - head/sys/fs/nfsserver
Message-ID:  <202009182352.08INquT0095579@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: rmacklem
Date: Fri Sep 18 23:52:56 2020
New Revision: 365895
URL: https://svnweb.freebsd.org/changeset/base/365895

Log:
  Fix a LOR between the NFS server and server side krpc.
  
  Recent testing of the NFS-over-TLS code found a LOR between the mutex lock
  used for sessions and the sleep lock used for server side krpc socket
  structures in nfsrv_checksequence().  This was fixed by r365789.
  A similar bug exists in nfsrv_bindconnsess(), where SVC_RELEASE() is called
  while mutexes are held.
  This patch applies a fix similar to r365789, moving the SVC_RELEASE() call
  down to after the mutexes are released.
  
  This patch fixes the problem by moving the SVC_RELEASE() call in
  nfsrv_checksequence() down a few lines to below where the mutex is released.
  
  MFC after:	1 week

Modified:
  head/sys/fs/nfsserver/nfs_nfsdstate.c

Modified: head/sys/fs/nfsserver/nfs_nfsdstate.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdstate.c	Fri Sep 18 23:21:24 2020	(r365894)
+++ head/sys/fs/nfsserver/nfs_nfsdstate.c	Fri Sep 18 23:52:56 2020	(r365895)
@@ -6424,6 +6424,7 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t 
 	int error;
 
 	error = 0;
+	savxprt = NULL;
 	shp = NFSSESSIONHASH(sessionid);
 	NFSLOCKSTATE();
 	NFSLOCKSESSION(shp);
@@ -6451,8 +6452,6 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t 
 				/* Disable idle timeout. */
 				nd->nd_xprt->xp_idletimeout = 0;
 				sep->sess_cbsess.nfsess_xprt = nd->nd_xprt;
-				if (savxprt != NULL)
-					SVC_RELEASE(savxprt);
 				sep->sess_crflags |= NFSV4CRSESS_CONNBACKCHAN;
 				clp->lc_flags |= LCL_DONEBINDCONN;
 				if (*foreaftp == NFSCDFS4_BACK)
@@ -6479,6 +6478,8 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t 
 		error = NFSERR_BADSESSION;
 	NFSUNLOCKSESSION(shp);
 	NFSUNLOCKSTATE();
+	if (savxprt != NULL)
+		SVC_RELEASE(savxprt);
 	return (error);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202009182352.08INquT0095579>