Re: [PATCH] lockd: fix use-after-free in nlmsvc_retry_blocked()

[Abdifatah Suruur <suruurism@gmail.com>]

Resending in plain text: the list rejected my earlier reply as HTML.
Chuck already has this; apologies for the duplicate.

Hi Chuck,

Thanks for the quick review and the detailed explanation -- both points
are well taken.

On the retry path: I hadn't checked nfsd-testing before sending; agreed,
it's the same fix in the same place. I'll drop this patch and base any
future lockd/NFSD work on your nfsd-testing branch.

On nlmsvc_notify_blocked(): you're right, and thanks for spelling it
out. I missed that __locks_wake_up_blocks() clears waiter->flc_blocker
only after lm_notify returns (the smp_store_release in fs/locks.c), so
any concurrent locks_delete_block() from the GRANT_RES/CANCEL paths has
to acquire blocked_lock_lock and wait for the callback to finish. The
list reference can't be dropped between the spin_unlock() and the
svc_wake_up(), so there's no window there. Please disregard that hunk.

Thanks again for the explanation -- it also tells me where to look next
time.

Regards,
Abdifatah