afs: Fix refcounting in callback registration
authorDavid Howells <dhowells@redhat.com>
Thu, 10 May 2018 07:43:04 +0000 (08:43 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Jun 2018 19:01:43 +0000 (04:01 +0900)
commit350c1869e9adc3b2881b9c1575937bbc0f31f353
tree560cefcac9fc75a7c7f20a87cce921617d8357a3
parent5d18c2b0548b7755514dde6a6bbd90d32fccc7ca
afs: Fix refcounting in callback registration

[ Upstream commit d4a96bec7a7362834ef5c31d7b2cc9bf36eb0570 ]

The refcounting on afs_cb_interest struct objects in
afs_register_server_cb_interest() is wrong as it uses the server list
entry's call back interest pointer without regard for the fact that it
might be replaced at any time and the object thrown away.

Fix this by:

 (1) Put a lock on the afs_server_list struct that can be used to
     mediate access to the callback interest pointers in the servers array.

 (2) Keep a ref on the callback interest that we get from the entry.

 (3) Dropping the old reference held by vnode->cb_interest if we replace
     the pointer.

Fixes: c435ee34551e ("afs: Overhaul the callback handling")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/afs/callback.c
fs/afs/internal.h
fs/afs/rotate.c
fs/afs/server_list.c