nfs: cleanup inode_ref/inode_unref to fix inode leaks and extra unrefs

Signed-off-by: Anand V. Avati <avati@blackhole.gluster.com>
Signed-off-by: Anand V. Avati <avati@dev.gluster.com>

BUG: 2195 (Crash in __inode_retire on NFS failover)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2195

3 files changed, 66 insertions, 16 deletions

diff --git a/xlators/nfs/server/src/nfs-inodes.c b/xlators/nfs/server/src/nfs-inodes.c
index cd334525d..ddc1a9c0d 100644
--- a/xlators/nfs/server/src/nfs-inodes.c
+++ b/xlators/nfs/server/src/nfs-inodes.c
@@ -74,11 +74,12 @@ nfs_inode_create_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 {
         struct nfs_fop_local    *nfl = frame->local;
         fop_create_cbk_t        progcbk = NULL;
+        inode_t                 *linked_inode = NULL;
 
         if (op_ret == -1)
                 goto do_not_link;
 
-        inode_link (inode, nfl->parent, nfl->path, buf);
+        linked_inode = inode_link (inode, nfl->parent, nfl->path, buf);
 
 do_not_link:
         /* NFS does not need it, upper layers should not expect the pointer to
@@ -90,6 +91,12 @@ do_not_link:
         if (progcbk)
                 progcbk (frame, cookie, this, op_ret, op_errno, fd, inode, buf,
                          preparent, postparent);
+
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         return 0;
 }
 
@@ -139,11 +146,12 @@ nfs_inode_mkdir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 {
         struct nfs_fop_local    *nfl = frame->local;
         fop_mkdir_cbk_t         progcbk = NULL;
+        inode_t                 *linked_inode = NULL;
 
         if (op_ret == -1)
                 goto do_not_link;
 
-        inode_link (inode, nfl->parent, nfl->path, buf);
+        linked_inode = inode_link (inode, nfl->parent, nfl->path, buf);
 
 do_not_link:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
@@ -151,6 +159,11 @@ do_not_link:
                 progcbk (frame, cookie, this, op_ret, op_errno, inode, buf,
                          preparent, postparent);
 
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         return 0;
 }
 
@@ -296,18 +309,25 @@ nfs_inode_link_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 {
         struct nfs_fop_local    *nfl = NULL;
         fop_link_cbk_t          progcbk = NULL;
+        inode_t                 *linked_inode = NULL;
 
         if (op_ret == -1)
                 goto do_not_link;
 
         nfl = frame->local;
-        inode_link (inode, nfl->newparent, nfl->path, buf);
+        linked_inode = inode_link (inode, nfl->newparent, nfl->path, buf);
 
 do_not_link:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
         if (progcbk)
                 progcbk (frame, cookie, this, op_ret, op_errno, inode, buf,
                          preparent, postparent);
+
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         return 0;
 }
 
@@ -349,6 +369,7 @@ nfs_inode_unlink_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
                 goto do_not_unlink;
 
         inode_unlink (nfl->inode, nfl->parent, nfl->path);
+        inode_forget (nfl->inode, 0);
 
 do_not_unlink:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
@@ -396,6 +417,7 @@ nfs_inode_rmdir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
                 goto do_not_unlink;
 
         inode_unlink (nfl->inode, nfl->parent, nfl->path);
+        inode_forget (nfl->inode, 0);
 
 do_not_unlink:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
@@ -438,19 +460,26 @@ nfs_inode_mknod_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 {
         struct nfs_fop_local    *nfl = NULL;
         fop_mknod_cbk_t         progcbk = NULL;
+        inode_t                 *linked_inode = NULL;
 
         nfl = frame->local;
 
         if (op_ret == -1)
                 goto do_not_link;
 
-        inode_link (inode, nfl->parent, nfl->path, buf);
+        linked_inode = inode_link (inode, nfl->parent, nfl->path, buf);
 
 do_not_link:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
         if (progcbk)
                 progcbk (frame, cookie, this, op_ret, op_errno, inode, buf,
                          preparent, postparent);
+
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         return 0;
 }
 
@@ -488,12 +517,13 @@ nfs_inode_symlink_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 {
         struct nfs_fop_local    *nfl = NULL;
         fop_symlink_cbk_t       progcbk = NULL;
+        inode_t                 *linked_inode = NULL;
 
         nfl = frame->local;
         if (op_ret == -1)
                 goto do_not_link;
 
-        inode_link (inode, nfl->parent, nfl->path, buf);
+        linked_inode = inode_link (inode, nfl->parent, nfl->path, buf);
 
 do_not_link:
         inodes_nfl_to_prog_data (nfl, progcbk, frame);
@@ -501,6 +531,11 @@ do_not_link:
                 progcbk (frame, cookie, this, op_ret, op_errno, inode, buf,
                          preparent, postparent);
 
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         return 0;
 }
 
diff --git a/xlators/nfs/server/src/nfs3-helpers.c b/xlators/nfs/server/src/nfs3-helpers.c
index f64f049a3..61ef1bef5 100644
--- a/xlators/nfs/server/src/nfs3-helpers.c
+++ b/xlators/nfs/server/src/nfs3-helpers.c
@@ -2570,6 +2570,7 @@ nfs3_fh_resolve_entry_lookup_cbk (call_frame_t *frame, void *cookie,
                                   struct iatt *postparent)
 {
         nfs3_call_state_t       *cs = NULL;
+        inode_t                 *linked_inode = NULL;
 
         cs = frame->local;
         cs->resolve_ret = op_ret;
@@ -2583,7 +2584,12 @@ nfs3_fh_resolve_entry_lookup_cbk (call_frame_t *frame, void *cookie,
                 gf_log (GF_NFS3, GF_LOG_TRACE, "Entry looked up: %s",
                         cs->resolvedloc.path);
 
-        inode_link (inode, cs->resolvedloc.parent, cs->resolvedloc.name, buf);
+        linked_inode = inode_link (inode, cs->resolvedloc.parent,
+                                   cs->resolvedloc.name, buf);
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
 err:
         nfs3_call_resume (cs);
         return 0;
@@ -2634,6 +2640,7 @@ nfs3_fh_resolve_parent_lookup_cbk (call_frame_t *frame, void *cookie,
                                   struct iatt *postparent)
 {
         nfs3_call_state_t       *cs = NULL;
+        inode_t                 *linked_inode = NULL;
 
         cs = frame->local;
         cs->resolve_ret = op_ret;
@@ -2648,7 +2655,12 @@ nfs3_fh_resolve_parent_lookup_cbk (call_frame_t *frame, void *cookie,
                 gf_log (GF_NFS3, GF_LOG_TRACE, "Entry looked up: %s",
                         cs->resolvedloc.path);
 
-        inode_link (inode, cs->resolvedloc.parent, cs->resolvedloc.name, buf);
+        linked_inode = inode_link (inode, cs->resolvedloc.parent,
+                                   cs->resolvedloc.name, buf);
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
         nfs3_fh_resolve_entry_hard (cs);
 
 err:
@@ -2749,6 +2761,7 @@ nfs3_fh_resolve_dir_lookup_cbk (call_frame_t *frame, void *cookie,
 {
         nfs3_call_state_t       *cs = NULL;
         nfs_user_t              nfu = {0, };
+        inode_t                 *linked_inode = NULL;
 
         cs = frame->local;
         cs->resolve_ret = op_ret;
@@ -2764,7 +2777,13 @@ nfs3_fh_resolve_dir_lookup_cbk (call_frame_t *frame, void *cookie,
                         cs->resolvedloc.path);
 
         nfs_user_root_create (&nfu);
-        inode_link (inode, cs->resolvedloc.parent, cs->resolvedloc.name, buf);
+        linked_inode = inode_link (inode, cs->resolvedloc.parent,
+                                   cs->resolvedloc.name, buf);
+        if (linked_inode) {
+                inode_lookup (linked_inode);
+                inode_unref (linked_inode);
+        }
+
         nfs_opendir (cs->nfsx, cs->vol, &nfu, &cs->resolvedloc,
                      nfs3_fh_resolve_opendir_cbk, cs);
 
diff --git a/xlators/nfs/server/src/nfs3.c b/xlators/nfs/server/src/nfs3.c
index 4c2b47045..443ec5265 100644
--- a/xlators/nfs/server/src/nfs3.c
+++ b/xlators/nfs/server/src/nfs3.c
@@ -1029,7 +1029,6 @@ nfs3_fresh_lookup (nfs3_call_state_t *cs)
         gf_log (GF_NFS3, GF_LOG_DEBUG, "inode needs fresh lookup");
         inode_unlink (cs->resolvedloc.inode, cs->resolvedloc.parent,
                       cs->resolventry);
-        inode_unref (cs->resolvedloc.inode);
         nfs_loc_wipe (&cs->resolvedloc);
 
         /* Store pointer to currently allocated resolventry because it gets over
@@ -1065,7 +1064,6 @@ nfs3svc_lookup_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
 
         nfs3_fh_build_child_fh (&cs->parent, buf, &newfh);
         oldinode = inode_link (inode, cs->resolvedloc.parent, cs->resolvedloc.name, buf);
-        inode_unref (oldinode);
 xmit_res:
         /* Only send fresh lookup if it was a revalidate that failed. */
         if ((op_ret ==  -1) && (nfs3_is_revalidate_lookup (cs))) {
@@ -1078,6 +1076,10 @@ xmit_res:
         nfs3_lookup_reply (cs->req, status, &newfh, buf, postparent);
         nfs3_call_state_wipe (cs);
 out:
+        if (oldinode) {
+                inode_lookup (oldinode);
+                inode_unref (oldinode);
+        }
         return 0;
 }
 
@@ -3188,11 +3190,6 @@ nfs3svc_remove_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
                 nfs3_fdcache_remove (nfs3, openfd);
          }
 
-         /* This is the unref equivalent of the ref done when the inode was
-          * created on a lookup or a create request.
-          * The inode is finally unrefed in call state wipe.
-          */
-        inode_unref (cs->resolvedloc.inode);
 do_not_unref_cached_fd:
         nfs3_log_common_res (nfs_rpcsvc_request_xid (cs->req), "REMOVE", stat,
                              op_errno);
@@ -3352,7 +3349,6 @@ nfs3svc_rmdir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
         if (op_ret == -1)
                 stat = nfs3_errno_to_nfsstat3 (op_errno);
         else {
-                inode_unref (cs->resolvedloc.inode);
                 stat = NFS3_OK;
         }