Rajesh Prasad has uploaded this change for review.

View Change

Fix NULL ev_p Crash During Blocked Lock Grant

Bug: Ganesha crashes with a NULL dereference in `svc_rqst_expire_insert`
when granting a blocked NFSv4 lock to a client that disconnected before
the grant was attempted.

Event Sequence:

Client A - Acquires lock on file F
Client B - Requests same lock; placed in blocked-lock queue
           (`STATE_BLOCKING`)
Client B - Disconnect — `svc_rqst_unreg()` clears `rec->ev_p = NULL
Client A - Issues `LOCKU` — lock released
Ganesha - Calls `grant_blocked_locks()` — Client B's entry is the
          first candidate
Ganesha - `nfsv4_granted_callback()` → `nfs_rpc_cb_single()` →
          `nfs_rpc_call()` → `CLNT_CALL_BACK()` →
          `clnt_req_callback()` → `svc_rqst_expire_insert()`
CRASH - `sr_rec = cx->cx_rec->ev_p` is `NULL` →
        `mutex_lock(sr_rec->)` → SIGSEGV

Fix:
Before building the `CB_COMPOUND` payload, verify the client still has a
working back channel.

NFSv4.0 — read the `cb_chan_down` flag
NFSv4.1/4.2 — scan `cb_session_list` under `cid_mutex` for any
              session that has `session_bc_up` set

Handle RPC failure case -
Covers the narrow race where the transport is destroyed after the
pre-check passes but before (or during) the RPC send. If RPC failed,
remove entry, try next.

Used `STATE_ESTALE` to cleans up correctly -
`try_to_grant_lock()` handles the return value of the callback:

```
STATE_LOCK_BLOCKED  → restore sle_blocked, leave in list (will retry)
STATE_SUCCESS       → return (lock granted, entry promoted)
anything else       → fall through to remove_from_locklist()
```

`STATE_ESTALE` is "anything else", so the entry is removed.
`grant_blocked_locks()` uses `glist_for_each_safe`, so after the entry
is removed the loop automatically advances to the next blocked waiter.

Change-Id: I119d51ff60fb20022a1e38e3c1c510da8f45dcb2
Signed-off-by: Rajesh Prasad <raprasad@redhat.com>
---
M src/Protocols/NFS/nfs4_op_lock.c
1 file changed, 69 insertions(+), 7 deletions(-)

git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/47/1245847/1

To view, visit change 1245847. To unsubscribe, or for help writing mail filters, visit settings.