nfsd: fix startup/shutdown order bug

We must create the server before we can call init_socks or check the
number of threads.

Symptoms were a NULL pointer dereference in nfsd_svc().  Problem
identified by Jeff Layton.

Also fix a minor cleanup-on-error case in nfsd_startup().

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

1 files changed, 16 insertions, 14 deletions

diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 92173bde32d2..39ced4a52c5f 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -204,6 +204,9 @@ static bool nfsd_up = false;
 static int nfsd_startup(unsigned short port, int nrservs)
 {
         int ret;
+
+        if (nfsd_up)
+                return 0;
         /*
          * Readahead param cache - will no-op if it already exists.
          * (Note therefore results will be suboptimal if number of
@@ -217,7 +220,7 @@ static int nfsd_startup(unsigned short port, int nrservs)
                 goto out_racache;
         ret = lockd_up();
         if (ret)
-                return ret;
+                goto out_racache;
         ret = nfs4_state_start();
         if (ret)
                 goto out_lockd;
@@ -420,7 +423,7 @@ int
 nfsd_svc(unsigned short port, int nrservs)
 {
         int     error;
-        bool    first_thread;
+        bool    nfsd_up_before;
 
         mutex_lock(&nfsd_mutex);
         dprintk("nfsd: creating service\n");
@@ -432,29 +435,28 @@ nfsd_svc(unsigned short port, int nrservs)
         if (nrservs == 0 && nfsd_serv == NULL)
                 goto out;
 
-        first_thread = (nfsd_serv->sv_nrthreads == 0) && (nrservs != 0);
-
-        if (first_thread) {
-                error = nfsd_startup(port, nrservs);
-                if (error)
-                        goto out;
-        }
         error = nfsd_create_serv();
         if (error)
-                goto out_shutdown;
-        error = svc_set_num_threads(nfsd_serv, NULL, nrservs);
+                goto out;
+
+        nfsd_up_before = nfsd_up;
+
+        error = nfsd_startup(port, nrservs);
         if (error)
                 goto out_destroy;
+        error = svc_set_num_threads(nfsd_serv, NULL, nrservs);
+        if (error)
+                goto out_shutdown;
         /* We are holding a reference to nfsd_serv which
          * we don't want to count in the return value,
          * so subtract 1
          */
         error = nfsd_serv->sv_nrthreads - 1;
-out_destroy:
-        svc_destroy(nfsd_serv);         /* Release server */
 out_shutdown:
-        if (error < 0 && first_thread)
+        if (error < 0 && !nfsd_up_before)
                 nfsd_shutdown();
+out_destroy:
+        svc_destroy(nfsd_serv);         /* Release server */
 out:
         mutex_unlock(&nfsd_mutex);
         return error;