locks,lockd: fix race in nlmsvc_testlock

posix_test_lock() returns a pointer to a struct file_lock which is unprotected
and can be removed while in use by the caller.  Move the conflicting lock from
the return to a parameter, and copy the conflicting lock.

In most cases the caller ends up putting the copy of the conflicting lock on
the stack.  On i386, sizeof(struct file_lock) appears to be about 100 bytes.
We're assuming that's reasonable.

Signed-off-by: Andy Adamson <andros@citi.umich.edu>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 5 insertions, 7 deletions

diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index f5398097b84b..d683dd022e08 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -376,8 +376,6 @@ u32
 nlmsvc_testlock(struct nlm_file *file, struct nlm_lock *lock,
                                        struct nlm_lock *conflock)
 {
-        struct file_lock        *fl;
-
         dprintk("lockd: nlmsvc_testlock(%s/%ld, ty=%d, %Ld-%Ld)\n",
                                 file->f_file->f_dentry->d_inode->i_sb->s_id,
                                 file->f_file->f_dentry->d_inode->i_ino,
@@ -385,14 +383,14 @@ nlmsvc_testlock(struct nlm_file *file, struct nlm_lock *lock,
                                 (long long)lock->fl.fl_start,
                                 (long long)lock->fl.fl_end);
 
-        if ((fl = posix_test_lock(file->f_file, &lock->fl)) != NULL) {
+        if (posix_test_lock(file->f_file, &lock->fl, &conflock->fl)) {
                 dprintk("lockd: conflicting lock(ty=%d, %Ld-%Ld)\n",
-                                fl->fl_type, (long long)fl->fl_start,
-                                (long long)fl->fl_end);
+                                conflock->fl.fl_type,
+                                (long long)conflock->fl.fl_start,
+                                (long long)conflock->fl.fl_end);
                 conflock->caller = "somehost";  /* FIXME */
                 conflock->oh.len = 0;           /* don't return OH info */
-                conflock->svid = fl->fl_pid;
-                conflock->fl = *fl;
+                conflock->svid = conflock->fl.fl_pid;
                 return nlm_lck_denied;
         }