diff options
| author | Trond Myklebust <[email protected]> | 2023-10-08 14:20:19 -0400 |
|---|---|---|
| committer | Anna Schumaker <[email protected]> | 2023-10-18 14:41:52 -0400 |
| commit | f63955721a8020e979b99cc417dcb6da3106aa24 (patch) | |
| tree | 2396587080a0b5a0fb721d5406ddaf80a855dfe7 /lib/test_fortify/write_overflow-strncpy-src.c | |
| parent | 6a6d4644ce935ddec4f76223ac0ca68da56bd2d3 (diff) | |
pNFS: Fix a hang in nfs4_evict_inode()
We are not allowed to call pnfs_mark_matching_lsegs_return() without
also holding a reference to the layout header, since doing so could lead
to the reference count going to zero when we call
pnfs_layout_remove_lseg(). This again can lead to a hang when we get to
nfs4_evict_inode() and are unable to clear the layout pointer.
pnfs_layout_return_unused_byserver() is guilty of this behaviour, and
has been seen to trigger the refcount warning prior to a hang.
Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode")
Cc: [email protected]
Signed-off-by: Trond Myklebust <[email protected]>
Signed-off-by: Anna Schumaker <[email protected]>
Diffstat (limited to 'lib/test_fortify/write_overflow-strncpy-src.c')
0 files changed, 0 insertions, 0 deletions