Patch "nfs: Don't take a reference on fl->fl_file for LOCK operation" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

    nfs: Don't take a reference on fl->fl_file for LOCK operation

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfs-don-t-take-a-reference-on-fl-fl_file-for-lock-operation.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Benjamin Coddington <[email protected]>
Date: Thu, 5 Jan 2017 10:20:16 -0500
Subject: nfs: Don't take a reference on fl->fl_file for LOCK operation

From: Benjamin Coddington <[email protected]>

[ Upstream commit 4b09ec4b14a168bf2c687e1f598140c3c11e9222 ]

I have reports of a crash that look like __fput() was called twice for a NFSv4.0 file. It seems possible that the state manager could try to reclaim a lock and take a reference on the fl->fl_file at the same time the file is being released if, during the close(), a signal interrupts the wait for outstanding IO while removing locks which then skips the removal of that lock.

Since 83bfff23e9ed ("nfs4: have do_vfs_lock take an inode pointer") has removed the need to traverse fl->fl_file->f_inode in nfs4_lock_done(), taking that reference is no longer necessary.

---
 fs/nfs/nfs4proc.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -38,7 +38,6 @@
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
-#include <linux/file.h>
 #include <linux/string.h>
 #include <linux/ratelimit.h>
 #include <linux/printk.h>

@@ -5544,7 +5543,6 @@ static struct nfs4_lockdata *nfs4_alloc_
 	p->server = server;
 	atomic_inc(&lsp->ls_count);
 	p->ctx = get_nfs_open_context(ctx);
-	get_file(fl->fl_file);
 	memcpy(&p->fl, fl, sizeof(p->fl));
 	return p;
 out_free_seqid:

@@ -5634,7 +5632,6 @@ static void nfs4_lock_release(void *call
 		nfs_free_seqid(data->arg.lock_seqid);
 	nfs4_put_lock_state(data->lsp);
 	put_nfs_open_context(data->ctx);
-	fput(data->fl.fl_file);
 	kfree(data);
 	dprintk("%s: done!\n", __func__);
 }

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/nfs-don-t-take-a-reference-on-fl-fl_file-for-lock-operation.patch