afs: Fix mmap

Fix afs_add_open_map() to check that the vnode isn't already on the list
when it adds it.  It's possible that afs_drop_open_mmap() decremented
the cb_nr_mmap counter, but hadn't yet got into the locked section to
remove it.

Also vnode->cb_mmap_link should be initialised, so fix that too.

Fixes: 5c5ec604ae2a ("afs: Fix mmap coherency vs 3rd-party changes")
Reported-by: kafs-testing+fedora34_64checkkafs-build-300@auristor.com
Suggested-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: kafs-testing+fedora34_64checkkafs-build-300@auristor.com
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/686465.1639435380@warthog.procyon.org.uk/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/afs/file.c b/fs/afs/file.c
index cb6ad61eec3bf5f30d5d6477b0bb7635f131b4bc..afe4b803f84b46d319e4885fdbc6ea8a1919cf40 100644 (file)
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -514,8 +514,9 @@ static void afs_add_open_mmap(struct afs_vnode *vnode)
        if (atomic_inc_return(&vnode->cb_nr_mmap) == 1) {
                down_write(&vnode->volume->cell->fs_open_mmaps_lock);
 
-               list_add_tail(&vnode->cb_mmap_link,
-                             &vnode->volume->cell->fs_open_mmaps);
+               if (list_empty(&vnode->cb_mmap_link))
+                       list_add_tail(&vnode->cb_mmap_link,
+                                     &vnode->volume->cell->fs_open_mmaps);
 
                up_write(&vnode->volume->cell->fs_open_mmaps_lock);
        }

diff --git a/fs/afs/super.c b/fs/afs/super.c
index d110def8aa8eb993212c00ed161089eba89a7545..34c68724c98bec4070dd56de816c07ea78c2db99 100644 (file)
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -667,6 +667,7 @@ static void afs_i_init_once(void *_vnode)
        INIT_LIST_HEAD(&vnode->pending_locks);
        INIT_LIST_HEAD(&vnode->granted_locks);
        INIT_DELAYED_WORK(&vnode->lock_work, afs_lock_work);
+       INIT_LIST_HEAD(&vnode->cb_mmap_link);
        seqlock_init(&vnode->cb_lock);
 }