aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRick Macklem <rmacklem@FreeBSD.org>2020-09-18 23:52:56 +0000
committerRick Macklem <rmacklem@FreeBSD.org>2020-09-18 23:52:56 +0000
commit58dd2b52cba9a68c0a4f2b3f579516d9e5c2345f (patch)
tree17568568020962a0c89a3023df4f5eb36a0f3047
parent2c48331d28f16c0efce5a72a81e7d71668c4a158 (diff)
downloadsrc-58dd2b52cba9a68c0a4f2b3f579516d9e5c2345f.tar.gz
src-58dd2b52cba9a68c0a4f2b3f579516d9e5c2345f.zip
Fix a LOR between the NFS server and server side krpc.
Recent testing of the NFS-over-TLS code found a LOR between the mutex lock used for sessions and the sleep lock used for server side krpc socket structures in nfsrv_checksequence(). This was fixed by r365789. A similar bug exists in nfsrv_bindconnsess(), where SVC_RELEASE() is called while mutexes are held. This patch applies a fix similar to r365789, moving the SVC_RELEASE() call down to after the mutexes are released. This patch fixes the problem by moving the SVC_RELEASE() call in nfsrv_checksequence() down a few lines to below where the mutex is released. MFC after: 1 week
Notes
Notes: svn path=/head/; revision=365895
-rw-r--r--sys/fs/nfsserver/nfs_nfsdstate.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c
index 5732e9bbba7a..15e2b8fea275 100644
--- a/sys/fs/nfsserver/nfs_nfsdstate.c
+++ b/sys/fs/nfsserver/nfs_nfsdstate.c
@@ -6424,6 +6424,7 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t *sessionid, int *foreaftp)
int error;
error = 0;
+ savxprt = NULL;
shp = NFSSESSIONHASH(sessionid);
NFSLOCKSTATE();
NFSLOCKSESSION(shp);
@@ -6451,8 +6452,6 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t *sessionid, int *foreaftp)
/* Disable idle timeout. */
nd->nd_xprt->xp_idletimeout = 0;
sep->sess_cbsess.nfsess_xprt = nd->nd_xprt;
- if (savxprt != NULL)
- SVC_RELEASE(savxprt);
sep->sess_crflags |= NFSV4CRSESS_CONNBACKCHAN;
clp->lc_flags |= LCL_DONEBINDCONN;
if (*foreaftp == NFSCDFS4_BACK)
@@ -6479,6 +6478,8 @@ nfsrv_bindconnsess(struct nfsrv_descript *nd, uint8_t *sessionid, int *foreaftp)
error = NFSERR_BADSESSION;
NFSUNLOCKSESSION(shp);
NFSUNLOCKSTATE();
+ if (savxprt != NULL)
+ SVC_RELEASE(savxprt);
return (error);
}