linux-stable.git/net/sunrpc, branch v3.2.39

SUNRPC: Ensure we release the socket write lock if the rpc_task exits early

2013-02-06T04:33:27+00:00

commit 87ed50036b866db2ec2ba16b2a7aec4a2b0b7c39 upstream.

If the rpc_task exits while holding the socket write lock before it has
allocated an rpc slot, then the usual mechanism for releasing the write
lock in xprt_release() is defeated.

The problem occurs if the call to xprt_lock_write() initially fails, so
that the rpc_task is put on the xprt->sending wait queue. If the task
exits after being assigned the lock by __xprt_lock_write_func, but
before it has retried the call to xprt_lock_and_alloc_slot(), then
it calls xprt_release() while holding the write lock, but will
immediately exit due to the test for task->tk_rqstp != NULL.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings

SUNRPC: Ensure that we free the rpc_task after cleanups are done

2013-01-16T01:13:19+00:00

commit c6567ed1402c55e19b012e66a8398baec2a726f3 upstream.

This patch ensures that we free the rpc_task after the cleanup callbacks
are done in order to avoid a deadlock problem that can be triggered if
the callback needs to wait for another workqueue item to complete.

Signed-off-by: Trond Myklebust 
Cc: Weston Andros Adamson 
Cc: Tejun Heo 
Cc: Bruce Fields 
Signed-off-by: Ben Hutchings

SUNRPC: Get rid of the xs_error_report socket callback

2012-10-30T23:26:57+00:00

commit f878b657ce8e7d3673afe48110ec208a29e38c4a upstream.

Chris Perl reports that we're seeing races between the wakeup call in
xs_error_report and the connect attempts. Basically, Chris has shown
that in certain circumstances, the call to xs_error_report causes the
rpc_task that is responsible for reconnecting to wake up early, thus
triggering a disconnect and retry.

Since the sk->sk_error_report() calls in the socket layer are always
followed by a tcp_done() in the cases where we care about waking up
the rpc_tasks, just let the state_change callbacks take responsibility
for those wake ups.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Prevent races in xs_abort_connection()

2012-10-30T23:26:57+00:00

commit 4bc1e68ed6a8b59be8a79eb719be515a55c7bc68 upstream.

The call to xprt_disconnect_done() that is triggered by a successful
connection reset will trigger another automatic wakeup of all tasks
on the xprt->pending rpc_wait_queue. In particular it will cause an
early wake up of the task that called xprt_connect().

All we really want to do here is clear all the socket-specific state
flags, so we split that functionality out of xs_sock_mark_closed()
into a helper that can be called by xs_abort_connection()

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

Revert "SUNRPC: Ensure we close the socket on EPIPE errors too..."

2012-10-30T23:26:56+00:00

commit b9d2bb2ee537424a7f855e1f93eed44eb9ee0854 upstream.

This reverts commit 55420c24a0d4d1fce70ca713f84aa00b6b74a70e.
Now that we clear the connected flag when entering TCP_CLOSE_WAIT,
the deadlock described in this commit is no longer possible.
Instead, the resulting call to xs_tcp_shutdown() can interfere
with pending reconnection attempts.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Clear the connect flag when socket state is TCP_CLOSE_WAIT

2012-10-30T23:26:56+00:00

commit d0bea455dd48da1ecbd04fedf00eb89437455fdc upstream.

This is needed to ensure that we call xprt_connect() upon the next
call to call_connect().

Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Prevent kernel stack corruption on long values of flush

2012-10-30T23:26:49+00:00

commit 212ba90696ab4884e2025b0b13726d67aadc2cd4 upstream.

The buffer size in read_flush() is too small for the longest possible values
for it. This can lead to a kernel stack corruption:

[   43.047329] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff833e64b4
[   43.047329]
[   43.049030] Pid: 6015, comm: trinity-child18 Tainted: G        W    3.5.0-rc7-next-20120716-sasha #221
[   43.050038] Call Trace:
[   43.050435]  [] panic+0xcd/0x1f4
[   43.050931]  [] ? read_flush.isra.7+0xe4/0x100
[   43.051602]  [] __stack_chk_fail+0x16/0x20
[   43.052206]  [] read_flush.isra.7+0xe4/0x100
[   43.052951]  [] ? read_flush_pipefs+0x30/0x30
[   43.053594]  [] read_flush_procfs+0x2c/0x30
[   43.053596]  [] proc_reg_read+0x9c/0xd0
[   43.053596]  [] ? proc_reg_write+0xd0/0xd0
[   43.053596]  [] do_loop_readv_writev+0x4b/0x90
[   43.053596]  [] do_readv_writev+0xf6/0x1d0
[   43.053596]  [] vfs_readv+0x3e/0x60
[   43.053596]  [] sys_readv+0x48/0xb0
[   43.053596]  [] system_call_fastpath+0x1a/0x1f

Signed-off-by: Sasha Levin 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Ben Hutchings

SUNRPC: Set alloc_slot for backchannel tcp ops

2012-10-30T23:26:29+00:00

commit 84e28a307e376f271505af65a7b7e212dd6f61f4 upstream.

f39c1bfb5a03e2d255451bff05be0d7255298fa4 (SUNRPC: Fix a UDP transport
regression) introduced the "alloc_slot" function for xprt operations,
but never created one for the backchannel operations.  This patch fixes
a null pointer dereference when mounting NFS over v4.1.

Call Trace:
 [] ? xprt_reserve+0x47/0x50 [sunrpc]
 [] call_reserve+0x34/0x60 [sunrpc]
 [] __rpc_execute+0x90/0x400 [sunrpc]
 [] rpc_async_schedule+0x2a/0x40 [sunrpc]
 [] process_one_work+0x139/0x500
 [] ? alloc_worker+0x70/0x70
 [] ? __rpc_execute+0x400/0x400 [sunrpc]
 [] worker_thread+0x15e/0x460
 [] ? preempt_schedule+0x49/0x70
 [] ? rescuer_thread+0x230/0x230
 [] kthread+0x93/0xa0
 [] kernel_thread_helper+0x4/0x10
 [] ? kthread_freezable_should_stop+0x70/0x70
 [] ? gs_change+0x13/0x13

Signed-off-by: Bryan Schumaker 
Signed-off-by: Trond Myklebust 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT

2012-10-17T02:48:37+00:00

commit a519fc7a70d1a918574bb826cc6905b87b482eb9 upstream.

Instead of doing a shutdown() call, we need to do an actual close().
Ditto if/when the server is sending us junk RPC headers.

Signed-off-by: Trond Myklebust 
Tested-by: Simon Kirby 
Signed-off-by: Ben Hutchings

SUNRPC: Fix a UDP transport regression

2012-09-19T14:05:17+00:00

commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.

Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that
we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing
hangs in the case of NFS over UDP mounts.

Since neither the UDP or the RDMA transport mechanism use dynamic slot
allocation, we can skip grabbing the socket lock for those transports.
Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA
case.

Note that the NFSv4.1 back channel assigns the slot directly
through rpc_run_bc_task, so we can ignore that case.

Reported-by: Dick Streefland 
Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings