[lkml]   [2012]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/1] locks: prevent side-effects of locks_release_private before file_lock is initialized

There seems to be a regression in kernel 2.6.37 regarding the behavior of
fcntl(F_SETLEASE) when called for the second or third time. If fcntl(F_SETOWN)
or fcntl(F_SETSIG) was called before it, the second fcntl(F_SETLEASE) would undo
those settings.

It seems that the regression was introduced by these two commits which were
fixing a leak in a file_lock struct:
* 3df057ac9afe83c4af84016df3baf3a0eb1d3d33
* 8896b93f42459b18b145c69d399b62870df48061

To prevent the leak, a call to locks_free_lock() was added to free the file_lock
struct that was allocated but not used because the old one was reused. The
problem is that the allocated file_lock was already partially initialized with a
pointer to the file descriptor and that locks_free_lock() will then call
locks_release_private() which will call lease_release_private_callback() which
will call f_delown() and set f_owner.signum to 0, effectively undoing the
effects of fcntl(F_SETOWN) and fcntl(F_SETSIG) on that same file descriptor.

I thought of a solution in the lines of having lease_init() set fl_lmops = NULL
and have it set back to point to lease_manager_ops inside do_fcntl_add_lease()
only after it is valid, but I didn't manage to make that work... I also thought
of changing locks_free_lock() somehow to decide whether locks_release_private()
should be called or not (maybe an extra __locks_free_lock() function that would
not call locks_release_private() and could be inlined into locks_free_lock()?)
but in the end I decided to just replace the calls to locks_free_lock(fl) with
kmem_cache_free(filelock_cache, fl) directly on the places where the file_lock
struct was not yet fully initialized.

This issue was found on Samba and reported to their bugzilla at:

A more detailed description and discussion including a test case is at:


Filipe Brandenburger (1):
locks: prevent side-effects of locks_release_private before file_lock
is initialized

fs/locks.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)


 \ /
  Last update: 2012-06-16 05:41    [W:0.255 / U:0.596 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site