Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 16 Sep 2020 02:25:18 +0000 (UTC)
From:      Rick Macklem <rmacklem@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r365789 - head/sys/fs/nfsserver
Message-ID:  <202009160225.08G2PIBr018412@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: rmacklem
Date: Wed Sep 16 02:25:18 2020
New Revision: 365789
URL: https://svnweb.freebsd.org/changeset/base/365789

Log:
  Fix a LOR between the NFS server and server side krpc.
  
  Recent testing of the NFS-over-TLS code found a LOR between the mutex lock
  used for sessions and the sleep lock used for server side krpc socket
  structures.
  The code in nfsrv_checksequence() would call SVC_RELEASE() with the mutex
  held.  Normally this is ok, since all that happens is SVC_RELEASE()
  decrements a reference count.  However, if the socket has just been shut
  down, SVC_RELEASE() drops the reference count to 0 and acquires a sleep
  lock during destruction of the server side krpc structure.
  
  This patch fixes the problem by moving the SVC_RELEASE() call in
  nfsrv_checksequence() down a few lines to below where the mutex is released.
  
  MFC after:	1 week

Modified:
  head/sys/fs/nfsserver/nfs_nfsdstate.c

Modified: head/sys/fs/nfsserver/nfs_nfsdstate.c
==============================================================================
--- head/sys/fs/nfsserver/nfs_nfsdstate.c	Tue Sep 15 23:03:56 2020	(r365788)
+++ head/sys/fs/nfsserver/nfs_nfsdstate.c	Wed Sep 16 02:25:18 2020	(r365789)
@@ -6233,6 +6233,7 @@ nfsrv_checksequence(struct nfsrv_descript *nd, uint32_
 	 * bound as well, do the implicit binding unless a
 	 * BindConnectiontoSession has already been done on the session.
 	 */
+	savxprt = NULL;
 	if (sep->sess_clp->lc_req.nr_client != NULL &&
 	    sep->sess_cbsess.nfsess_xprt != nd->nd_xprt &&
 	    (sep->sess_crflags & NFSV4CRSESS_CONNBACKCHAN) != 0 &&
@@ -6245,14 +6246,14 @@ nfsrv_checksequence(struct nfsrv_descript *nd, uint32_
 		    sep->sess_clp->lc_req.nr_client->cl_private;
 		nd->nd_xprt->xp_idletimeout = 0;	/* Disable timeout. */
 		sep->sess_cbsess.nfsess_xprt = nd->nd_xprt;
-		if (savxprt != NULL)
-			SVC_RELEASE(savxprt);
 	}
 
 	*sflagsp = 0;
 	if (sep->sess_clp->lc_req.nr_client == NULL)
 		*sflagsp |= NFSV4SEQ_CBPATHDOWN;
 	NFSUNLOCKSESSION(shp);
+	if (savxprt != NULL)
+		SVC_RELEASE(savxprt);
 	if (error == NFSERR_EXPIRED) {
 		*sflagsp |= NFSV4SEQ_EXPIREDALLSTATEREVOKED;
 		error = 0;

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202009160225.08G2PIBr018412>