aboutsummaryrefslogtreecommitdiffstats
path: root/net/sunrpc/svcsock.c
diff options
context:
space:
mode:
authorNeil Brown <neilb@suse.de>2006-10-30 01:46:45 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2006-10-30 15:08:42 -0500
commitd6740df98e12a8e49ef3a699dcc1e2913f22c51b (patch)
treeded79841a8570d3a3aa46154f3bfc4eaa21900d9 /net/sunrpc/svcsock.c
parent2b52c9590d5ad2fb67b720ec12018dd2cf061480 (diff)
[PATCH] sunrpc: fix refcounting problems in rpc servers
A recent patch fixed a problem which would occur when the refcount on an auth_domain reached zero. This problem has not been reported in practice despite existing in two major kernel releases because the refcount can never reach zero. This patch fixes the problems that stop the refcount reaching zero. 1/ We were adding to the refcount when inserting in the hash table, but only removing from the hashtable when the refcount reached zero. Obviously it never would. So don't count the implied reference of being in the hash table. 2/ There are two paths on which a socket can be destroyed. One called svcauth_unix_info_release(). The other didn't. So when the other was taken, we can lose a reference to an ip_map which in-turn holds a reference to an auth_domain So unify the exit paths into svc_sock_put. This highlights the fact that svc_delete_socket has slightly odd semantics - it does not drop a reference but probably should. Fixing this need a bit more thought and testing. Signed-off-by: Neil Brown <neilb@suse.de> Cc: Trond Myklebust <trond.myklebust@fys.uio.no> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc/svcsock.c')
-rw-r--r--net/sunrpc/svcsock.c30
1 files changed, 14 insertions, 16 deletions
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 96521f16342b..db0d1048d466 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -300,8 +300,13 @@ static inline void
300svc_sock_put(struct svc_sock *svsk) 300svc_sock_put(struct svc_sock *svsk)
301{ 301{
302 if (atomic_dec_and_test(&svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) { 302 if (atomic_dec_and_test(&svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) {
303 dprintk("svc: releasing dead socket\n"); 303 printk("svc: releasing dead socket\n");
304 sock_release(svsk->sk_sock); 304 if (svsk->sk_sock->file)
305 sockfd_put(svsk->sk_sock);
306 else
307 sock_release(svsk->sk_sock);
308 if (svsk->sk_info_authunix != NULL)
309 svcauth_unix_info_release(svsk->sk_info_authunix);
305 kfree(svsk); 310 kfree(svsk);
306 } 311 }
307} 312}
@@ -1604,20 +1609,13 @@ svc_delete_socket(struct svc_sock *svsk)
1604 if (test_bit(SK_TEMP, &svsk->sk_flags)) 1609 if (test_bit(SK_TEMP, &svsk->sk_flags))
1605 serv->sv_tmpcnt--; 1610 serv->sv_tmpcnt--;
1606 1611
1607 if (!atomic_read(&svsk->sk_inuse)) { 1612 /* This atomic_inc should be needed - svc_delete_socket
1608 spin_unlock_bh(&serv->sv_lock); 1613 * should have the semantic of dropping a reference.
1609 if (svsk->sk_sock->file) 1614 * But it doesn't yet....
1610 sockfd_put(svsk->sk_sock); 1615 */
1611 else 1616 atomic_inc(&svsk->sk_inuse);
1612 sock_release(svsk->sk_sock); 1617 spin_unlock_bh(&serv->sv_lock);
1613 if (svsk->sk_info_authunix != NULL) 1618 svc_sock_put(svsk);
1614 svcauth_unix_info_release(svsk->sk_info_authunix);
1615 kfree(svsk);
1616 } else {
1617 spin_unlock_bh(&serv->sv_lock);
1618 dprintk(KERN_NOTICE "svc: server socket destroy delayed\n");
1619 /* svsk->sk_server = NULL; */
1620 }
1621} 1619}
1622 1620
1623/* 1621/*