[PATCH] network block device driver, kernel 2.4

[Lou Langholtz]

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.

--=_courier-7160-1050224355-0001-2
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Here's a simple patch to nbd.c to fix some of the potential for oopses 
(and possible corruption) should the nbd-client that handed off a socket 
exit (implicitly closing the socket), while the driver is still sending 
requests onto that socket. The oops can easily be seen when root runs 
"nbd-client -d /dev/nbX" after /dev/nbX has been setup and still has a 
bunch of I/O buffered up (and is sending requests to the socket to 
handle the queue). This patch doesn't change functionality.

Louis D. Langholtz

--=_courier-7160-1050224355-0001-2
Content-Type: text/plain; name="nbd.diff"; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="nbd.diff"

--- linux-2.4.20/drivers/block/nbd.c	2002-08-02 18:39:43.000000000 -0600
+++ linux/drivers/block/nbd.c	2003-04-13 02:24:26.000000000 -0600
@@ -26,6 +26,8 @@
  *   reduce number of partial TCP segments sent. <[e-mail]>
  * 01-12-6 Fix deadlock condition by making queue locks independant of
  *   the transmit lock. <[e-mail]>
+ * 03-04-12 Fix some possible ways to oops from the nbd-client closing the
+ *   socket it gave us while we're still using that socket. <[e-mail]>
  *
  * possible FIXME: make set_sock / set_blksize / set_size / do_it one syscall
  * why not: would need verify_area and friends, would share yet another 
@@ -153,7 +155,7 @@
 	int result;
 	struct nbd_request request;
 	unsigned long size = req->nr_sectors << 9;
-	struct socket *sock = lo->sock;
+	struct socket *sock;
 
 	DEBUG("NBD: sending control, ");
 	request.magic = htonl(NBD_REQUEST_MAGIC);
@@ -163,6 +165,8 @@
 	memcpy(request.handle, &req, sizeof(req));
 
 	down(&lo->tx_lock);
+	sock = lo->sock;
+	if (!sock) goto error_out; /* we got cleared */
 
 	result = nbd_xmit(1, sock, (char *) &request, sizeof(request), req->cmd == WRITE ? MSG_MORE : 0);
 	if (result <= 0)
@@ -402,7 +406,10 @@
 		if (!file)
 			return -EINVAL;
 		lo->file = NULL;
+		/* ensure we're not in critical section of nbd_send_req() */
+		down(&lo->tx_lock);
 		lo->sock = NULL;
+		up(&lo->tx_lock);
 		fput(file);
 		return 0;
 	case NBD_SET_SOCK:

--=_courier-7160-1050224355-0001-2--