pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception

Right now, we can call nfs_commit_inode() while holding the session slot,
which could lead to NFSv4 deadlocks. Ensure we only keep the slot if
the server returned a layout that we have to process.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

1 files changed, 10 insertions, 7 deletions

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ed45090e4df6..2c8c2696415e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8650,6 +8650,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
 
         dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
 
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
+
         switch (nfs4err) {
         case 0:
                 goto out;
@@ -8714,7 +8716,6 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 goto out;
         }
 
-        nfs4_sequence_free_slot(&lgp->res.seq_res);
         err = nfs4_handle_exception(server, nfs4err, exception);
         if (!status) {
                 if (exception->retry)
@@ -8786,20 +8787,22 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout)
         if (IS_ERR(task))
                 return ERR_CAST(task);
         status = rpc_wait_for_completion_task(task);
-        if (status == 0) {
+        if (status != 0)
+                goto out;
+
+        /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+        if (task->tk_status < 0 || lgp->res.layoutp->len == 0) {
                 status = nfs4_layoutget_handle_exception(task, lgp, &exception);
                 *timeout = exception.timeout;
-        }
-
+        } else
+                lseg = pnfs_layout_process(lgp);
+out:
         trace_nfs4_layoutget(lgp->args.ctx,
                         &lgp->args.range,
                         &lgp->res.range,
                         &lgp->res.stateid,
                         status);
 
-        /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
-        if (status == 0 && lgp->res.layoutp->len)
-                lseg = pnfs_layout_process(lgp);
         rpc_put_task(task);
         dprintk("<-- %s status=%d\n", __func__, status);
         if (status)