linux-stable.git/fs/nfs/callback_proc.c, branch linux-4.7.y

NFSv4.1: Fix Oopsable condition in server callback races

2016-09-24T08:09:27+00:00

commit e09c978aae5bedfdb379be80363b024b7d82638b upstream.

The slot table hasn't been an array since v3.7. Ensure that we
use nfs4_lookup_slot() to access the slot correctly.

Fixes: 87dda67e7386 ("NFSv4.1: Allow SEQUENCE to resize the slot table...")
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

pnfs: only tear down lsegs that precede seqid in LAYOUTRETURN args

2016-05-17T19:48:10+00:00

LAYOUTRETURN is "special" in that servers and clients are expected to
work with old stateids. When the client sends a LAYOUTRETURN with an old
stateid in it then the server is expected to only tear down layout
segments that were present when that seqid was current. Ensure that the
client handles its accounting accordingly.

Signed-off-by: Jeff Layton 
Signed-off-by: Anna Schumaker

Fixing oops in callback path

2016-05-17T19:45:00+00:00

Commit 80f9642724af5 ("NFSv4.x: Enforce the ca_maxreponsesize_cached
on the back channel") causes an oops when it receives a callback with
cachethis=yes.

[  109.667378] BUG: unable to handle kernel NULL pointer dereference at 00000000000002c8
[  109.669476] IP: [] nfs4_callback_compound+0x4f8/0x690 [nfsv4]
[  109.671216] PGD 0
[  109.671736] Oops: 0000 [#1] SMP
[  109.705427] CPU: 1 PID: 3579 Comm: nfsv4.1-svc Not tainted 4.5.0-rc1+ #1
[  109.706987] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
[  109.709468] task: ffff8800b4408000 ti: ffff88008448c000 task.ti: ffff88008448c000
[  109.711207] RIP: 0010:[]  [] nfs4_callback_compound+0x4f8/0x690 [nfsv4]
[  109.713521] RSP: 0018:ffff88008448fca0  EFLAGS: 00010286
[  109.714762] RAX: ffff880081ee202c RBX: ffff8800b7b5b600 RCX: 0000000000000001
[  109.716427] RDX: 0000000000000008 RSI: 0000000000000008 RDI: 0000000000000000
[  109.718091] RBP: ffff88008448fda8 R08: 0000000000000000 R09: 000000000b000000
[  109.719757] R10: ffff880137786000 R11: ffff8800b7b5b600 R12: 0000000001000000
[  109.721415] R13: 0000000000000002 R14: 0000000053270000 R15: 000000000000000b
[  109.723061] FS:  0000000000000000(0000) GS:ffff880139640000(0000) knlGS:0000000000000000
[  109.724931] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  109.726278] CR2: 00000000000002c8 CR3: 0000000034d50000 CR4: 00000000001406e0
[  109.727972] Stack:
[  109.728465]  ffff880081ee202c ffff880081ee201c 000000008448fcc0 ffff8800baccb800
[  109.730349]  ffff8800baccc800 ffffffffa08d0380 0000000000000000 0000000000000000
[  109.732211]  ffff8800b7b5b600 0000000000000001 ffffffff81d073c0 ffff880081ee3090
[  109.734056] Call Trace:
[  109.734657]  [] svc_process_common+0x5c4/0x6c0 [sunrpc]
[  109.736267]  [] bc_svc_process+0x1fc/0x360 [sunrpc]
[  109.737775]  [] nfs41_callback_svc+0x10c/0x1d0 [nfsv4]
[  109.739335]  [] ? prepare_to_wait_event+0xf0/0xf0
[  109.740799]  [] ? nfs4_callback_svc+0x50/0x50 [nfsv4]
[  109.742349]  [] kthread+0xd8/0xf0
[  109.743495]  [] ? kthread_park+0x60/0x60
[  109.744776]  [] ret_from_fork+0x3f/0x70
[  109.746037]  [] ? kthread_park+0x60/0x60
[  109.747324] Code: cc 45 31 f6 48 8b 85 00 ff ff ff 44 89 30 48 8b 85 f8 fe ff ff 44 89 20 48 8b 9d 38 ff ff ff 48 8b bd 30 ff ff ff 48 85 db 74 4c <4c> 8b af c8 02 00 00 4d 8d a5 08 02 00 00 49 81 c5 98 02 00 00
[  109.754361] RIP  [] nfs4_callback_compound+0x4f8/0x690 [nfsv4]
[  109.756123]  RSP 
[  109.756951] CR2: 00000000000002c8
[  109.757738] ---[ end trace 2b8555511ab5dfb4 ]---
[  109.758819] Kernel panic - not syncing: Fatal exception
[  109.760126] Kernel Offset: disabled
[  118.938934] ---[ end Kernel panic - not syncing: Fatal exception

It doesn't unlock the table nor does it set the cps->clp pointer which
is later needed by nfs4_cb_free_slot().

Fixes: 80f9642724af5 ("NFSv4.x: Enforce the ca_maxresponsesize_cached ...")
CC: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia 
Signed-off-by: Anna Schumaker

NFSv4.x: Fix NFS4ERR_RETRY_UNCACHED_REP in nfs4_callback_sequence

2016-02-01T17:06:24+00:00

We need to initialize cb_sequenceres information when reporting a
NFS4ERR_RETRY_UNCACHED_REP error, since that will apply to the
next operation, not to the CB_SEQUENCE itself.

Reported-by: Kinglong Mee 
Signed-off-by: Trond Myklebust

NFSv4.x: Allow multiple callbacks in flight

2016-01-25T14:36:21+00:00

Hook the callback channel into the same session management machinery
as we use for the forward channel.

Signed-off-by: Trond Myklebust

NFSv4.x: Fix wraparound issues when validing the callback sequence id

2016-01-24T22:12:49+00:00

We need to make sure that we don't allow args->csa_sequenceid == 0.

Signed-off-by: Trond Myklebust

NFSv4.x: Enforce the ca_maxresponsesize_cached on the back channel

2016-01-24T22:12:48+00:00

We have no duplicate reply cache, so we always set the back channel
ca_maxresponsesize_cached to zero when negotiating the session.
That means we should always error out as soon as we see the server
set args->csa_cachethis.

Signed-off-by: Trond Myklebust

NFSv4.x: CB_SEQUENCE should return NFS4ERR_DELAY if still executing

2016-01-24T22:12:48+00:00

See RFC5661 Section 2.10.6.2: if retrying a request, and the old one is
still in progress, we must return NFS4ERR_DELAY as the reply to sequence.

Signed-off-by: Trond Myklebust

NFSv4.x: Remove hard coded slotids in callback channel

2016-01-24T22:12:47+00:00

Instead, use the values encoded in the slot table itself.

Signed-off-by: Trond Myklebust

NFSv4.1/pNFS: Fix a race in initiate_file_draining()

2016-01-04T17:36:12+00:00

Peng Tao points out that the call to pnfs_mark_matching_lsegs_return()
could race with pnfs_put_lseg(), in which case the layout segment is
cleared, but no layoutreturn will be sent.
Fix is to replace the call to pnfs_mark_matching_lsegs_invalid().

Reported-by: Peng Tao 
Signed-off-by: Trond Myklebust