[RFC dlm/next 05/11] dlm: drop lkb hold for waiter conversion handling

[Alexander Aring <aahringo@redhat.com>]

Drop the extra reference holding when handling a conversion as a
conversion should never free a lkb. Adding more comments for unlock and
cancel case because internal remove_from_waiters() can end the lkb
lifetime.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
---
 fs/dlm/lock.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index 378234b42593..1f4f2d24bef4 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -5005,7 +5005,6 @@ static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb,
 				   struct dlm_message *ms_local)
 {
 	if (middle_conversion(lkb)) {
-		hold_lkb(lkb);
 		memset(ms_local, 0, sizeof(struct dlm_message));
 		ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY);
 		ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS));
@@ -5015,7 +5014,6 @@ static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb,
 		/* Same special case as in receive_rcom_lock_args() */
 		lkb->lkb_grmode = DLM_LOCK_IV;
 		rsb_set_flag(lkb->lkb_resource, RSB_RECOVER_CONVERT);
-		unhold_lkb(lkb);
 
 	} else if (lkb->lkb_rqmode >= lkb->lkb_grmode) {
 		set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags);
@@ -5120,10 +5118,17 @@ void dlm_recover_waiters_pre(struct dlm_ls *ls)
 			break;
 
 		case DLM_MSG_CONVERT:
+			/* a convert should never end lkbs lifetime */
 			recover_convert_waiter(ls, lkb, ms_local);
 			break;
 
 		case DLM_MSG_UNLOCK:
+			/* _receive_unlock_reply() can call remove_from_waiters()
+			 * that leads to free the lkb and the reference of ther
+			 * iterating lkb for ls_waiters get drops. To prevent this
+			 * we need to hold the lkb here to prevent use after free
+			 * when the lkb is removed from the waiter.
+			 */
 			hold_lkb(lkb);
 			memset(ms_local, 0, sizeof(struct dlm_message));
 			ms_local->m_type = cpu_to_le32(DLM_MSG_UNLOCK_REPLY);
@@ -5134,6 +5139,12 @@ void dlm_recover_waiters_pre(struct dlm_ls *ls)
 			break;
 
 		case DLM_MSG_CANCEL:
+			/* _receive_cancel_reply() can call remove_from_waiters()
+			 * that leads to free the lkb and the reference of ther
+			 * iterating lkb for ls_waiters get drops. To prevent this
+			 * we need to hold the lkb here to prevent use after free
+			 * when the lkb is removed from the waiter.
+			 */
 			hold_lkb(lkb);
 			memset(ms_local, 0, sizeof(struct dlm_message));
 			ms_local->m_type = cpu_to_le32(DLM_MSG_CANCEL_REPLY);
-- 
2.43.0