[lkml]   [2012]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[PATCH 0/1] locks: prevent side-effects of locks_release_private before file_lock is initialized

    There seems to be a regression in kernel 2.6.37 regarding the behavior of
    fcntl(F_SETLEASE) when called for the second or third time. If fcntl(F_SETOWN)
    or fcntl(F_SETSIG) was called before it, the second fcntl(F_SETLEASE) would undo
    those settings.

    It seems that the regression was introduced by these two commits which were
    fixing a leak in a file_lock struct:
    * 3df057ac9afe83c4af84016df3baf3a0eb1d3d33
    * 8896b93f42459b18b145c69d399b62870df48061

    To prevent the leak, a call to locks_free_lock() was added to free the file_lock
    struct that was allocated but not used because the old one was reused. The
    problem is that the allocated file_lock was already partially initialized with a
    pointer to the file descriptor and that locks_free_lock() will then call
    locks_release_private() which will call lease_release_private_callback() which
    will call f_delown() and set f_owner.signum to 0, effectively undoing the
    effects of fcntl(F_SETOWN) and fcntl(F_SETSIG) on that same file descriptor.

    I thought of a solution in the lines of having lease_init() set fl_lmops = NULL
    and have it set back to point to lease_manager_ops inside do_fcntl_add_lease()
    only after it is valid, but I didn't manage to make that work... I also thought
    of changing locks_free_lock() somehow to decide whether locks_release_private()
    should be called or not (maybe an extra __locks_free_lock() function that would
    not call locks_release_private() and could be inlined into locks_free_lock()?)
    but in the end I decided to just replace the calls to locks_free_lock(fl) with
    kmem_cache_free(filelock_cache, fl) directly on the places where the file_lock
    struct was not yet fully initialized.

    This issue was found on Samba and reported to their bugzilla at:

    A more detailed description and discussion including a test case is at:


    Filipe Brandenburger (1):
    locks: prevent side-effects of locks_release_private before file_lock
    is initialized

    fs/locks.c | 8 ++++----
    1 files changed, 4 insertions(+), 4 deletions(-)


     \ /
      Last update: 2012-06-16 05:41    [W:0.043 / U:0.084 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site