sunrpc/cache: ensure items removed from cache do not have pending upcalls.

It is possible for a race to set CACHE_PENDING after cache_clean()
has removed a cache entry from the cache.
If CACHE_PENDING is still set when the entry is finally 'put',
the cache_dequeue() will never happen and we can leak memory.

So set a new flag 'CACHE_CLEANED' when we remove something from
the cache, and don't queue any upcall if it is set.

If CACHE_PENDING is set before CACHE_CLEANED, the call that
cache_clean() makes to cache_fresh_unlocked() will free memory
as needed.  If CACHE_PENDING is set after CACHE_CLEANED, the
test in sunrpc_cache_pipe_upcall will ensure that the memory
is not allocated.

Reported-by: <bstroesser@ts.fujitsu.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

2 files changed, 6 insertions, 1 deletions

diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
index 303399b1ba59..8419f7dbdab2 100644
--- a/include/linux/sunrpc/cache.h
+++ b/include/linux/sunrpc/cache.h
@@ -57,6 +57,7 @@ struct cache_head {
 #define CACHE_VALID     0       /* Entry contains valid data */
 #define CACHE_NEGATIVE  1       /* Negative entry - there is no match for the key */
 #define CACHE_PENDING   2       /* An upcall has been sent but no reply received yet*/
+#define CACHE_CLEANED   3       /* Entry has been cleaned from cache */
 
 #define CACHE_NEW_EXPIRY 120    /* keep new things pending confirmation for 120 seconds */
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 29c463396a2d..b12144c5edd0 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -306,7 +306,7 @@ EXPORT_SYMBOL_GPL(cache_check);
  * a current pointer into that list and into the table
  * for that entry.
  *
- * Each time clean_cache is called it finds the next non-empty entry
+ * Each time cache_clean is called it finds the next non-empty entry
  * in the current table and walks the list in that entry
  * looking for entries that can be removed.
  *
@@ -453,6 +453,7 @@ static int cache_clean(void)
                         current_index ++;
                 spin_unlock(&cache_list_lock);
                 if (ch) {
+                        set_bit(CACHE_CLEANED, &ch->flags);
                         cache_fresh_unlocked(ch, d);
                         cache_put(ch, d);
                 }
@@ -1178,6 +1179,9 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
                 warn_no_listener(detail);
                 return -EINVAL;
         }
+        if (test_bit(CACHE_CLEANED, &h->flags))
+                /* Too late to make an upcall */
+                return -EAGAIN;
 
         buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
         if (!buf)