linux-stable.git/fs/nfs, branch linux-4.5.y

nfs: avoid race that crashes nfs_init_commit

2016-06-08T01:18:53+00:00

commit ade8febde0271513360bac44883dbebad44276c3 upstream.

Since the patch "NFS: Allow multiple commit requests in flight per file"
we can run multiple simultaneous commits on the same inode.  This
introduced a race over collecting pages to commit that made it possible
to call nfs_init_commit() with an empty list - which causes crashes like
the one below.

The fix is to catch this race and avoid calling nfs_init_commit and
initiate_commit when there is no work to do.

Here is the crash:

[600522.076832] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
[600522.078475] IP: [] nfs_init_commit+0x22/0x130 [nfs]
[600522.078745] PGD 4272b1067 PUD 4272cb067 PMD 0
[600522.078972] Oops: 0000 [#1] SMP
[600522.079204] Modules linked in: nfsv3 nfs_layout_flexfiles rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache dcdbas ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw vmw_vsock_vmci_transport vsock bonding ipmi_devintf ipmi_msghandler coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ppdev vmw_balloon parport_pc parport acpi_cpufreq vmw_vmci i2c_piix4 shpchp nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c vmwgfx drm_kms_helper ttm drm crc32c_intel serio_raw vmxnet3
[600522.081380]  vmw_pvscsi ata_generic pata_acpi
[600522.081809] CPU: 3 PID: 15667 Comm: /usr/bin/python Not tainted 4.1.9-100.pd.88.el7.x86_64 #1
[600522.082281] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 09/30/2014
[600522.082814] task: ffff8800bbbfa780 ti: ffff88042ae84000 task.ti: ffff88042ae84000
[600522.083378] RIP: 0010:[]  [] nfs_init_commit+0x22/0x130 [nfs]
[600522.083973] RSP: 0018:ffff88042ae87438  EFLAGS: 00010246
[600522.084571] RAX: 0000000000000000 RBX: ffff880003485e40 RCX: ffff88042ae87588
[600522.085188] RDX: 0000000000000000 RSI: ffff88042ae874b0 RDI: ffff880003485e40
[600522.085756] RBP: ffff88042ae87448 R08: ffff880003486010 R09: ffff88042ae874b0
[600522.086332] R10: 0000000000000000 R11: 0000000000000005 R12: ffff88042ae872d0
[600522.086905] R13: ffff88042ae874b0 R14: ffff880003485e40 R15: ffff88042704c840
[600522.087484] FS:  00007f4728ff2740(0000) GS:ffff88043fd80000(0000) knlGS:0000000000000000
[600522.088070] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[600522.088663] CR2: 0000000000000040 CR3: 000000042b6aa000 CR4: 00000000001406e0
[600522.089327] Stack:
[600522.089926]  0000000000000001 ffff88042ae87588 ffff88042ae874f8 ffffffffa04f09fa
[600522.090549]  0000000000017840 0000000000017840 ffff88042ae87588 ffff8803258d9930
[600522.091169]  ffff88042ae87578 ffffffffa0563d80 0000000000000000 ffff88042704c840
[600522.091789] Call Trace:
[600522.092420]  [] pnfs_generic_commit_pagelist+0x1da/0x320 [nfsv4]
[600522.093052]  [] ? ff_layout_commit_prepare_v3+0x30/0x30 [nfs_layout_flexfiles]
[600522.093696]  [] ff_layout_commit_pagelist+0x15/0x20 [nfs_layout_flexfiles]
[600522.094359]  [] nfs_generic_commit_list+0xe8/0x120 [nfs]
[600522.095032]  [] nfs_commit_inode+0xba/0x110 [nfs]
[600522.095719]  [] nfs_release_page+0x44/0xd0 [nfs]
[600522.096410]  [] try_to_release_page+0x32/0x50
[600522.097109]  [] shrink_page_list+0x961/0xb30
[600522.097812]  [] shrink_inactive_list+0x1cd/0x550
[600522.098530]  [] shrink_lruvec+0x635/0x840
[600522.099250]  [] shrink_zone+0xf0/0x2f0
[600522.099974]  [] do_try_to_free_pages+0x192/0x470
[600522.100709]  [] try_to_free_pages+0xda/0x170
[600522.101464]  [] __alloc_pages_nodemask+0x588/0x970
[600522.102235]  [] alloc_pages_vma+0xb5/0x230
[600522.103000]  [] ? cpumask_any_but+0x39/0x50
[600522.103774]  [] wp_page_copy.isra.55+0x95/0x490
[600522.104558]  [] ? __wake_up+0x48/0x60
[600522.105357]  [] do_wp_page+0xab/0x4f0
[600522.106137]  [] ? release_task+0x36b/0x470
[600522.106902]  [] ? eventfd_ctx_read+0x67/0x1c0
[600522.107659]  [] handle_mm_fault+0xc78/0x1900
[600522.108431]  [] __do_page_fault+0x181/0x420
[600522.109173]  [] ? __audit_syscall_exit+0x1e6/0x280
[600522.109893]  [] do_page_fault+0x30/0x80
[600522.110594]  [] ? syscall_trace_leave+0xc6/0x120
[600522.111288]  [] page_fault+0x28/0x30
[600522.111947] Code: 5d c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 4c 8d 87 d0 01 00 00 48 89 e5 53 48 89 fb 48 83 ec 08 4c 8b 0e 49 8b 41 18 4c 39 ce <48> 8b 40 40 4c 8b 50 30 74 24 48 8b 87 d0 01 00 00 48 8b 7e 08
[600522.113343] RIP  [] nfs_init_commit+0x22/0x130 [nfs]
[600522.114003]  RSP 
[600522.114636] CR2: 0000000000000040

Fixes: af7cf057 (NFS: Allow multiple commit requests in flight per file)
Signed-off-by: Weston Andros Adamson 
Signed-off-by: Anna Schumaker 
Signed-off-by: Greg Kroah-Hartman

nfs: use file_dentry()

2016-04-20T06:45:24+00:00

commit be62a1a8fd116f5cd9e53726601f970e16e17558 upstream.

NFS may be used as lower layer of overlayfs and accessing f_path.dentry can
lead to a crash.

Fix by replacing direct access of file->f_path.dentry with the
file_dentry() accessor, which will always return a native object.

Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Miklos Szeredi 
Tested-by: Goldwyn Rodrigues 
Acked-by: Trond Myklebust 
Signed-off-by: Theodore Ts'o 
Cc: David Howells 
Cc: Al Viro 
Signed-off-by: Greg Kroah-Hartman

NFSv4.x/pnfs: Fix a race between layoutget and bulk recalls

2016-02-22T22:46:34+00:00

Replace another case where the layout 'plh_block_lgets' can trigger
infinite loops in send_layoutget().

Signed-off-by: Trond Myklebust

NFSv4.x/pnfs: Fix a race between layoutget and pnfs_destroy_layout

2016-02-22T22:34:59+00:00

If the server reboots while there is a layoutget outstanding, then
the call to pnfs_choose_layoutget_stateid() will fail with an EAGAIN
error, which causes an infinite loop in send_layoutget(). The reason
why we never break out of the loop is that the layout 'plh_block_lgets'
field is never cleared.

Fix is to replace plh_block_lgets with NFS_LAYOUT_INVALID_STID, which
can be reset after a new layoutget.

Fixes: ab7d763e477c5 ("pNFS: Ensure nfs4_layoutget_prepare returns...")
Signed-off-by: Trond Myklebust

pnfs/blocklayout: fix a memeory leak when using,vmalloc_to_page

2016-02-17T16:44:45+00:00

unreferenced object 0xffffc90000abf000 (size 16900):
  comm "fsync02", pid 15765, jiffies 4297431627 (age 423.772s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 a0 c2 19 00 88 ff ff  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] __vmalloc_node_range+0x231/0x280
    [] __vmalloc+0x4a/0x50
    [] ext_tree_prepare_commit+0x231/0x2e0 [blocklayoutdriver]
    [] bl_prepare_layoutcommit+0xe/0x10 [blocklayoutdriver]
    [] pnfs_layoutcommit_inode+0x29c/0x330 [nfsv4]
    [] pnfs_generic_sync+0x13/0x20 [nfsv4]
    [] nfs4_file_fsync+0x58/0x150 [nfsv4]
    [] vfs_fsync_range+0x4b/0xb0
    [] do_fsync+0x3d/0x70
    [] SyS_fsync+0x10/0x20
    [] entry_SYSCALL_64_fastpath+0x12/0x76
    [] 0xffffffffffffffff

v2, add missing include header

Signed-off-by: Kinglong Mee 
Signed-off-by: Trond Myklebust

nfs4: fix stateid handling for the NFS v4.2 operations

2016-02-17T16:38:07+00:00

The newly added NFS v4.2 operations (ALLOCATE, DEALLOCATE, SEEK and CLONE)
use a helper called nfs42_set_rw_stateid to select a stateid that is sent
to the server.  But they don't set the inode and state fields in the
nfs4_exception structure, and this don't partake in the stateid recovery
protocol.  Because of this they will simply return errors insted of trying
to recover a stateid when the server return a BAD_STATEID error.

Additionally CLONE has the problem that it operates on two files and thus
two stateids, and thus needs to call the exception handler twice to
recover stateids.

While we're at it stop grabbing an addititional reference to the open
context in all these operations - having the file open guarantees that
the open context won't go away.

All this can be produces with the generic/168 and generic/170 tests in
xfstests which stress the CLONE stateid handling.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Trond Myklebust

NFSv4: Fix a dentry leak on alias use

2016-02-17T16:35:25+00:00

In the case where d_add_unique() finds an appropriate alias to use it will
have already incremented the reference count.  An additional dget() to swap
the open context's dentry is unnecessary and will leak a reference.

Signed-off-by: Benjamin Coddington 
Fixes: 275bb307865a3 ("NFSv4: Move dentry instantiation into the NFSv4-...")
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Trond Myklebust

pNFS: Always set NFS_LAYOUT_RETURN_REQUESTED with lo->plh_return_iomode

2016-02-15T18:03:30+00:00

When setting the layout return mode, we must always also set the
NFS_LAYOUT_RETURN_REQUESTED flag to ensure that we send a layoutreturn.
Otherwise pnfs_error_mark_layout_for_return() could set the mode, but
fail to send the layoutreturn because another is already in flight.

Signed-off-by: Trond Myklebust

pNFS: Fix pnfs_mark_matching_lsegs_return()

2016-02-15T17:56:01+00:00

We don't need to schedule a layoutreturn if the layout segment can
be freed immediately.

Signed-off-by: Trond Myklebust

NFS: Cleanup - rename NFS_LAYOUT_RETURN_BEFORE_CLOSE

2016-01-28T01:40:05+00:00

NFS_LAYOUT_RETURN_BEFORE_CLOSE is being used to signal that a
layoutreturn is needed, either due to a layout recall or to a
layout error. Rename it to NFS_LAYOUT_RETURN_REQUESTED in order
to clarify its purpose.

Signed-off-by: Trond Myklebust