[RFC PATCH 0/3] protect access to bc_serv

[Olga Kornievskaia <okorniev@redhat.com>]

This patch series tries to address the problem that can arise when
the client is shutting down but gets a backchannel request. As it
stands now, In nfs4_shutdown_client() we call nfs4_destroy_callback()
which would destroy/free the bc_serv structure stored in an xprt
structure. But the xprt structure is still around for a bit until
it's destroyed. If we get backchannel request after svc_destroy()
is called, then in xprt_complete_bc_request() we are accessing freed
memory.

I propose to use bc_pa_lock lock to protect access to the bc_serv
structure and make sure we free/nullify bc_serv under the lock
and then access it under a lock in  xs_complete_bs_request() and
rpcrdma_bc_receive_call().

Olga Kornievskaia (3):
  NFSv4.1: pass transport for callback shutdown
  SUNRPC: protect access to rpc_xprt bc_serv
  NFSv4.1: protect destroying and nullifying bc_serv structure

 fs/nfs/callback.c                 |  7 +++++--
 fs/nfs/callback.h                 |  3 ++-
 fs/nfs/nfs4client.c               |  9 +++++++--
 include/linux/sunrpc/bc_xprt.h    |  1 +
 net/sunrpc/backchannel_rqst.c     | 27 ++++++++++++++++++++++++---
 net/sunrpc/xprtrdma/backchannel.c | 11 +++++++----
 6 files changed, 46 insertions(+), 12 deletions(-)

-- 
2.47.1