nfsd41: Fix a crash when a callback is retried
authorBoaz Harrosh <bharrosh@panasas.com>
Tue, 29 Jun 2010 11:33:55 +0000 (14:33 +0300)
committerJ. Bruce Fields <bfields@redhat.com>
Fri, 6 Aug 2010 21:05:39 +0000 (17:05 -0400)
commitc18c821fd40ad0ffc199a55be874e556bf999416
treeba1830c90160a4f85a32552425a556b70e56bae1
parent774f8bbd9ef2e71d4ef4b89933d292091d31ca98
nfsd41: Fix a crash when a callback is retried

If a callback is retried at nfsd4_cb_recall_done() due to
some error, the returned rpc reply crashes here:

@@ -514,6 +514,7 @@ decode_cb_sequence(struct xdr_stream *xdr, struct nfsd4_cb_sequence *res,
  u32 dummy;
  __be32 *p;

 + BUG_ON(!res);
  if (res->cbs_minorversion == 0)
  return 0;

[BUG_ON added for demonstration]

This is because the nfsd4_cb_done_sequence() has NULLed out
the task->tk_msg.rpc_resp pointer.

Also eventually the rpc would use the new slot without making
sure it is free by calling nfsd41_cb_setup_sequence().

This problem was introduced by a 4.1 protocol addition patch:
[0421b5c5] nfsd41: Backchannel: Implement cb_recall over NFSv4.1

Which was overlooking the possibility of an RPC callback retries.
For not-4.1 case redoing the _prepare is harmless.

Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
fs/nfsd/nfs4callback.c