[PATCH 1/3] nfsd: nfsd_do_file_acquire should hold rcu_read_lock while getting refs

[Jeff Layton <jlayton@kernel.org>]

nfsd_file is RCU-freed, so it's possible that one could be found that's
in the process of being freed and the memory recycled. Ensure we hold
the rcu_read_lock while attempting to get a reference on the object.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/nfsd/filecache.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
index d5c57360b418..6237715bd23e 100644
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -1077,10 +1077,12 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
 
 retry:
 	/* Avoid allocation if the item is already in cache */
+	rcu_read_lock();
 	nf = rhashtable_lookup_fast(&nfsd_file_rhash_tbl, &key,
 				    nfsd_file_rhash_params);
 	if (nf)
 		nf = nfsd_file_get(nf);
+	rcu_read_unlock();
 	if (nf)
 		goto wait_for_construction;
 
@@ -1090,16 +1092,21 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
 		goto out_status;
 	}
 
+	rcu_read_lock();
 	nf = rhashtable_lookup_get_insert_key(&nfsd_file_rhash_tbl,
 					      &key, &new->nf_rhash,
 					      nfsd_file_rhash_params);
 	if (!nf) {
+		rcu_read_unlock();
 		nf = new;
 		goto open_file;
 	}
-	if (IS_ERR(nf))
+	if (IS_ERR(nf)) {
+		rcu_read_unlock();
 		goto insert_err;
+	}
 	nf = nfsd_file_get(nf);
+	rcu_read_unlock();
 	if (nf == NULL) {
 		nf = new;
 		goto open_file;
-- 
2.37.3