• Stanislav Kinsbursky's avatar
    SUNRPC: check RPC inode's pipe reference before dereferencing · 2c9030ee
    Stanislav Kinsbursky authored
    There are 2 tightly bound objects: pipe data (created for kernel needs, has
    reference to dentry, which depends on PipeFS mount/umount) and PipeFS
    dentry/inode pair (created on mount for user-space needs). They both
    independently may have or have not a valid reference to each other.
    This means, that we have to make sure, that pipe->dentry reference is valid on
    upcalls, and dentry->pipe reference is valid on downcalls. The latter check is
    absent - my fault.
    IOW, PipeFS dentry can be opened by some process (rpc.idmapd for example), but
    it's pipe data can belong to NFS mount, which was unmounted already and thus
    pipe data was destroyed.
    To fix this, pipe reference have to be set to NULL on rpc_unlink() and checked
    on PipeFS file operations instead of pipe->dentry check.
    
    Note: PipeFS "poll" file operation will be updated in next patch, because it's
    logic is more complicated.
    Signed-off-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
    2c9030ee
rpc_pipe.c 28.1 KB