4995 panic in nlm_prog_4

Reviewed by: Bryan Cantrill <bryan@joyent.com>
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Marcel Telka <marcel@telka.sk>
Approved by: Richard Lowe <richlowe@richlowe.net>

3 files changed, 41 insertions, 67 deletions

diff --git a/usr/src/uts/common/fs/nfs/nfs_export.c b/usr/src/uts/common/fs/nfs/nfs_export.c
index 66dff710dd..d0360fc06f 100644
--- a/usr/src/uts/common/fs/nfs/nfs_export.c
+++ b/usr/src/uts/common/fs/nfs/nfs_export.c
@@ -2281,33 +2281,6 @@ nfs_fhtovp(fhandle_t *fh, struct exportinfo *exi)
 }
 
 /*
- * Convert an fhandle into a vnode.
- * Uses the file id (fh_len + fh_data) in the fhandle to get the vnode.
- * WARNING: users of this routine must do a VN_RELE on the vnode when they
- * are done with it.
- * This is just like nfs_fhtovp() but without the exportinfo argument.
- */
-
-vnode_t *
-lm_fhtovp(fhandle_t *fh)
-{
-	register vfs_t *vfsp;
-	vnode_t *vp;
-	int error;
-
-	vfsp = getvfs(&fh->fh_fsid);
-	if (vfsp == NULL)
-		return (NULL);
-
-	error = VFS_VGET(vfsp, &vp, (fid_t *)&(fh->fh_len));
-	VFS_RELE(vfsp);
-	if (error || vp == NULL)
-		return (NULL);
-
-	return (vp);
-}
-
-/*
  * Convert an nfs_fh3 into a vnode.
  * Uses the file id (fh_len + fh_data) in the file handle to get the vnode.
  * WARNING: users of this routine must do a VN_RELE on the vnode when they
@@ -2350,40 +2323,6 @@ nfs3_fhtovp(nfs_fh3 *fh, struct exportinfo *exi)
 }
 
 /*
- * Convert an nfs_fh3 into a vnode.
- * Uses the file id (fh_len + fh_data) in the file handle to get the vnode.
- * WARNING: users of this routine must do a VN_RELE on the vnode when they
- * are done with it.
- * BTW: This is just like nfs3_fhtovp() but without the exportinfo arg.
- * Also, vfsp is accessed through getvfs() rather using exportinfo !!
- */
-
-vnode_t *
-lm_nfs3_fhtovp(nfs_fh3 *fh)
-{
-	vfs_t *vfsp;
-	vnode_t *vp;
-	int error;
-	fid_t *fidp;
-
-	if (fh->fh3_length < NFS3_OLDFHSIZE ||
-	    fh->fh3_length > NFS3_MAXFHSIZE)
-		return (NULL);
-
-	vfsp = getvfs(&fh->fh3_fsid);
-	if (vfsp == NULL)
-		return (NULL);
-	fidp = FH3TOFIDP(fh);
-
-	error = VFS_VGET(vfsp, &vp, fidp);
-	VFS_RELE(vfsp);
-	if (error || vp == NULL)
-		return (NULL);
-
-	return (vp);
-}
-
-/*
  * Convert an nfs_fh4 into a vnode.
  * Uses the file id (fh_len + fh_data) in the file handle to get the vnode.
  * WARNING: users of this routine must do a VN_RELE on the vnode when they
diff --git a/usr/src/uts/common/klm/nlm_service.c b/usr/src/uts/common/klm/nlm_service.c
index c170c1d208..d87e80448d 100644
--- a/usr/src/uts/common/klm/nlm_service.c
+++ b/usr/src/uts/common/klm/nlm_service.c
@@ -28,6 +28,7 @@
 /*
  * Copyright (c) 2012 by Delphix. All rights reserved.
  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2014 Joyent, Inc.  All rights reserved.
  */
 
 /*
@@ -159,6 +160,33 @@ nlm_init_flock(struct flock64 *fl, struct nlm4_lock *nl,
 }
 
 /*
+ * Convert an fhandle into a vnode.
+ * Uses the file id (fh_len + fh_data) in the fhandle to get the vnode.
+ * WARNING: users of this routine must do a VN_RELE on the vnode when they
+ * are done with it.
+ * This is just like nfs_fhtovp() but without the exportinfo argument.
+ */
+static vnode_t *
+lm_fhtovp(fhandle3_t *fh)
+{
+	vfs_t *vfsp;
+	vnode_t *vp;
+	int error;
+
+	vfsp = getvfs(&fh->_fh3_fsid);
+	if (vfsp == NULL)
+		return (NULL);
+
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
+	error = VFS_VGET(vfsp, &vp, (fid_t *)&(fh->_fh3_len));
+	VFS_RELE(vfsp);
+	if (error || vp == NULL)
+		return (NULL);
+
+	return (vp);
+}
+
+/*
  * Gets vnode from client's filehandle
  * NOTE: Holds vnode, it _must_ be explicitly
  * released by VN_RELE().
@@ -166,19 +194,28 @@ nlm_init_flock(struct flock64 *fl, struct nlm4_lock *nl,
 static vnode_t *
 nlm_fh_to_vp(struct netobj *fh)
 {
-	fhandle_t *fhp;
+	fhandle3_t *fhp;
 
 	/*
 	 * Get a vnode pointer for the given NFS file handle.
-	 * Note that it could be an NFSv2 for NFSv3 handle,
+	 * Note that it could be an NFSv2 or NFSv3 handle,
 	 * which means the size might vary.  (don't copy)
 	 */
-	if (fh->n_len < sizeof (*fhp))
+	if (fh->n_len < sizeof (fhandle_t))
 		return (NULL);
 
 	/* We know this is aligned (kmem_alloc) */
 	/* LINTED E_BAD_PTR_CAST_ALIGN */
-	fhp = (fhandle_t *)fh->n_bytes;
+	fhp = (fhandle3_t *)fh->n_bytes;
+
+	/*
+	 * See the comment for NFS_FH3MAXDATA in uts/common/nfs/nfs.h for
+	 * converting fhandles. Check the NFSv3 file handle size. The lockmgr
+	 * is not used for NFS v4.
+	 */
+	if (fhp->_fh3_len > NFS_FH3MAXDATA || fhp->_fh3_len == 0)
+		return (NULL);
+
 	return (lm_fhtovp(fhp));
 }
 
diff --git a/usr/src/uts/common/nfs/export.h b/usr/src/uts/common/nfs/export.h
index 821ff44fdd..03851c1fb8 100644
--- a/usr/src/uts/common/nfs/export.h
+++ b/usr/src/uts/common/nfs/export.h
@@ -558,8 +558,6 @@ extern int	makefh3(nfs_fh3 *, struct vnode *, struct exportinfo *);
 extern int	makefh3_ol(nfs_fh3 *, struct exportinfo *, uint_t);
 extern vnode_t *nfs_fhtovp(fhandle_t *, struct exportinfo *);
 extern vnode_t *nfs3_fhtovp(nfs_fh3 *, struct exportinfo *);
-extern vnode_t *lm_fhtovp(fhandle_t *);
-extern vnode_t *lm_nfs3_fhtovp(nfs_fh3 *);
 extern struct	exportinfo *checkexport(fsid_t *, struct fid *);
 extern struct	exportinfo *checkexport4(fsid_t *, struct fid *, vnode_t *);
 extern void	exi_hold(struct exportinfo *);