[nfs, rpc] crap with refcounting and rmmod races

[Al Viro <viro-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org>]

	There's something seriously screwed up with nfs4_closedata and
path_get()/path_put() in nfs4_do_close()/nfs4_free_closedata().

	Look: either we never call the latter before all preexisting
references to data->path.mnt are dropped, in which case we don't
need to grab/put the damn thing at all.  *OR* it is possible, in
which case that data->path.mnt might be the only thing that still
holds nfs.ko pinned down and right after the path_put() we might
be running code in a module with refcount 0.  Which is not a good
thing...

	Note that extra references to vfsmount do not prevent umount from
removing the sucker from the tree and dropping the preexisting reference
to it.  umount -l will do that just fine.

	This thing is called as ->rpc_release(); do we have anything
protecting the issuer of rpc_run_task() from being rmmod'ed before (or
during) the call of ->rpc_release()?
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html