[PATCH 4.6 049/203] nfsd: Extend the mutex holding region around in nfsd4_process_open2()

[Greg Kroah-Hartman]

4.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleg Drokin <gr...@linuxhacker.ru>

commit 5cc1fb2a093e254b656c64ff24b0b76bed1d34d9 upstream.

To avoid racing entry into nfs4_get_vfs_file().
Make init_open_stateid() return with locked stateid to be unlocked
by the caller.

Signed-off-by: Oleg Drokin <gr...@linuxhacker.ru>
Signed-off-by: J. Bruce Fields <bfie...@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 fs/nfsd/nfs4state.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3487,6 +3487,10 @@ init_open_stateid(struct nfs4_ol_stateid
        struct nfs4_openowner *oo = open->op_openowner;
        struct nfs4_ol_stateid *retstp = NULL;
 
+       /* We are moving these outside of the spinlocks to avoid the warnings */
+       mutex_init(&stp->st_mutex);
+       mutex_lock(&stp->st_mutex);
+
        spin_lock(&oo->oo_owner.so_client->cl_lock);
        spin_lock(&fp->fi_lock);
 
@@ -3502,13 +3506,17 @@ init_open_stateid(struct nfs4_ol_stateid
        stp->st_access_bmap = 0;
        stp->st_deny_bmap = 0;
        stp->st_openstp = NULL;
-       mutex_init(&stp->st_mutex);
        list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
        list_add(&stp->st_perfile, &fp->fi_stateids);
 
 out_unlock:
        spin_unlock(&fp->fi_lock);
        spin_unlock(&oo->oo_owner.so_client->cl_lock);
+       if (retstp) {
+               mutex_lock(&retstp->st_mutex);
+               /* Not that we need to, just for neatness */
+               mutex_unlock(&stp->st_mutex);
+       }
        return retstp;
 }
 
@@ -4344,11 +4352,14 @@ nfsd4_process_open2(struct svc_rqst *rqs
        } else {
                stp = open->op_stp;
                open->op_stp = NULL;
+               /*
+                * init_open_stateid() either returns a locked stateid
+                * it found, or initializes and locks the new one we passed in
+                */
                swapstp = init_open_stateid(stp, fp, open);
                if (swapstp) {
                        nfs4_put_stid(&stp->st_stid);
                        stp = swapstp;
-                       mutex_lock(&stp->st_mutex);
                        status = nfs4_upgrade_open(rqstp, fp, current_fh,
                                                stp, open);
                        if (status) {
@@ -4357,7 +4368,6 @@ nfsd4_process_open2(struct svc_rqst *rqs
                        }
                        goto upgrade_out;
                }
-               mutex_lock(&stp->st_mutex);
                status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
                if (status) {
                        mutex_unlock(&stp->st_mutex);