diff options
| author | NeilBrown <neilb@suse.de> | 2006-05-22 22:35:25 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-05-23 10:35:31 -0700 |
| commit | f2d395865faa2a7cd4620b07178e58cbb160ba08 (patch) | |
| tree | 01d3b090a4ce73eb346a2c55d99fe12d07d52906 | |
| parent | e46e490368f87032a6e54969194413339b35a385 (diff) | |
| download | kernel_samsung_aries-f2d395865faa2a7cd4620b07178e58cbb160ba08.zip kernel_samsung_aries-f2d395865faa2a7cd4620b07178e58cbb160ba08.tar.gz kernel_samsung_aries-f2d395865faa2a7cd4620b07178e58cbb160ba08.tar.bz2 | |
[PATCH] knfsd: Fix two problems that can cause rmmod nfsd to die
Both cause the 'entries' count in the export cache to be non-zero at module
removal time, so unregistering that cache fails and results in an oops.
1/ exp_pseudoroot (used for NFSv4 only) leaks a reference to an export
entry.
2/ sunrpc_cache_update doesn't increment the entries count when it adds
an entry.
Thanks to "david m. richter" <richterd@citi.umich.edu> for triggering the
problem and finding one of the bugs.
Cc: "david m. richter" <richterd@citi.umich.edu>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | fs/nfsd/export.c | 4 | ||||
| -rw-r--r-- | net/sunrpc/cache.c | 1 |
2 files changed, 4 insertions, 1 deletions
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 4e05781..3eec300 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -1066,9 +1066,11 @@ exp_pseudoroot(struct auth_domain *clp, struct svc_fh *fhp, rv = nfserr_perm; else if (IS_ERR(exp)) rv = nfserrno(PTR_ERR(exp)); - else + else { rv = fh_compose(fhp, exp, fsid_key->ek_dentry, NULL); + exp_put(exp); + } cache_put(&fsid_key->h, &svc_expkey_cache); return rv; } diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 3ac4193..7026b08 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -159,6 +159,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail, detail->update(tmp, new); tmp->next = *head; *head = tmp; + detail->entries++; cache_get(tmp); is_new = cache_fresh_locked(tmp, new->expiry_time); cache_fresh_locked(old, 0); |