From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756533AbZGUXIp (ORCPT ); Tue, 21 Jul 2009 19:08:45 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756480AbZGUXIo (ORCPT ); Tue, 21 Jul 2009 19:08:44 -0400 Received: from srv5.dvmed.net ([207.36.208.214]:40710 "EHLO mail.dvmed.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756366AbZGUXIn (ORCPT ); Tue, 21 Jul 2009 19:08:43 -0400 Message-ID: <4A664A76.5000902@garzik.org> Date: Tue, 21 Jul 2009 19:08:38 -0400 From: Jeff Garzik User-Agent: Thunderbird 2.0.0.21 (X11/20090320) MIME-Version: 1.0 To: Trond Myklebust CC: LKML , Linux NFS ML , "Rafael J. Wysocki" , Linus Torvalds Subject: Re: 2.6.31-rc3 nfsv4 client regression (oops) References: <4A5C3858.6070303@garzik.org> <1247571788.19099.32.camel@heimdal.trondhjem.org> In-Reply-To: <1247571788.19099.32.camel@heimdal.trondhjem.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -3.8 (---) X-Spam-Report: SpamAssassin version 3.2.5 on srv5.dvmed.net summary: Content analysis details: (-3.8 points, 5.0 required) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Trond Myklebust wrote: > NFSv4: Fix an Oops in nfs4_free_lock_state > > The oops http://www.kerneloops.org/raw.php?rawid=537858&msgid= appears to > be due to the nfs4_lock_state->ls_state field being uninitialised. This > happens if the call to nfs4_free_lock_state() is triggered at the end of > nfs4_get_lock_state(). > > The fixe is to move the initialisation of ls_state into the allocator. > > Signed-off-by: Trond Myklebust > --- > > fs/nfs/nfs4state.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > > diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c > index b73c5a7..65ca8c1 100644 > --- a/fs/nfs/nfs4state.c > +++ b/fs/nfs/nfs4state.c > @@ -553,6 +553,7 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f > INIT_LIST_HEAD(&lsp->ls_sequence.list); > lsp->ls_seqid.sequence = &lsp->ls_sequence; > atomic_set(&lsp->ls_count, 1); > + lsp->ls_state = state; > lsp->ls_owner = fl_owner; > spin_lock(&clp->cl_lock); > nfs_alloc_unique_id(&clp->cl_lockowner_id, &lsp->ls_id, 1, 64); > @@ -587,7 +588,6 @@ static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_ > if (lsp != NULL) > break; > if (new != NULL) { > - new->ls_state = state; > list_add(&new->ls_locks, &state->lock_states); > set_bit(LK_STATE_IN_USE, &state->flags); Ping? This is headed upstream, right? This oops fix has lived outside the tree for at least a week now, and IMO needs to move upstream... Jeff