linux-stable.git/net/sunrpc, branch v3.2.41

SUNRPC: Don't start the retransmission timer when out of socket space

2013-03-20T15:03:16+00:00

commit a9a6b52ee1baa865283a91eb8d443ee91adfca56 upstream.

If the socket is full, we're better off just waiting until it empties,
or until the connection is broken. The reason why we generally don't
want to time out is that the call to xprt->ops->release_xprt() will
trigger a connection reset, which isn't helpful...

Let's make an exception for soft RPC calls, since they have to provide
timeout guarantees.

Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings

svcrpc: make svc_age_temp_xprts enqueue under sv_lock

2013-03-06T03:24:01+00:00

commit e75bafbff2270993926abcc31358361db74a9bc2 upstream.

svc_age_temp_xprts expires xprts in a two-step process: first it takes
the sv_lock and moves the xprts to expire off their server-wide list
(sv_tempsocks or sv_permsocks) to a local list.  Then it drops the
sv_lock and enqueues and puts each one.

I see no reason for this: svc_xprt_enqueue() will take sp_lock, but the
sv_lock and sp_lock are not otherwise nested anywhere (and documentation
at the top of this file claims it's correct to nest these with sp_lock
inside.)

Tested-by: Jason Tibbitts 
Tested-by: Paweł Sikora 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Ben Hutchings

SUNRPC: Ensure we release the socket write lock if the rpc_task exits early

2013-02-06T04:33:27+00:00

commit 87ed50036b866db2ec2ba16b2a7aec4a2b0b7c39 upstream.

If the rpc_task exits while holding the socket write lock before it has
allocated an rpc slot, then the usual mechanism for releasing the write
lock in xprt_release() is defeated.

The problem occurs if the call to xprt_lock_write() initially fails, so
that the rpc_task is put on the xprt->sending wait queue. If the task
exits after being assigned the lock by __xprt_lock_write_func, but
before it has retried the call to xprt_lock_and_alloc_slot(), then
it calls xprt_release() while holding the write lock, but will
immediately exit due to the test for task->tk_rqstp != NULL.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings

SUNRPC: Ensure that we free the rpc_task after cleanups are done

2013-01-16T01:13:19+00:00

commit c6567ed1402c55e19b012e66a8398baec2a726f3 upstream.

This patch ensures that we free the rpc_task after the cleanup callbacks
are done in order to avoid a deadlock problem that can be triggered if
the callback needs to wait for another workqueue item to complete.

Signed-off-by: Trond Myklebust 
Cc: Weston Andros Adamson 
Cc: Tejun Heo 
Cc: Bruce Fields 
Signed-off-by: Ben Hutchings

SUNRPC: Get rid of the xs_error_report socket callback

2012-10-30T23:26:57+00:00

commit f878b657ce8e7d3673afe48110ec208a29e38c4a upstream.

Chris Perl reports that we're seeing races between the wakeup call in
xs_error_report and the connect attempts. Basically, Chris has shown
that in certain circumstances, the call to xs_error_report causes the
rpc_task that is responsible for reconnecting to wake up early, thus
triggering a disconnect and retry.

Since the sk->sk_error_report() calls in the socket layer are always
followed by a tcp_done() in the cases where we care about waking up
the rpc_tasks, just let the state_change callbacks take responsibility
for those wake ups.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Prevent races in xs_abort_connection()

2012-10-30T23:26:57+00:00

commit 4bc1e68ed6a8b59be8a79eb719be515a55c7bc68 upstream.

The call to xprt_disconnect_done() that is triggered by a successful
connection reset will trigger another automatic wakeup of all tasks
on the xprt->pending rpc_wait_queue. In particular it will cause an
early wake up of the task that called xprt_connect().

All we really want to do here is clear all the socket-specific state
flags, so we split that functionality out of xs_sock_mark_closed()
into a helper that can be called by xs_abort_connection()

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

Revert "SUNRPC: Ensure we close the socket on EPIPE errors too..."

2012-10-30T23:26:56+00:00

commit b9d2bb2ee537424a7f855e1f93eed44eb9ee0854 upstream.

This reverts commit 55420c24a0d4d1fce70ca713f84aa00b6b74a70e.
Now that we clear the connected flag when entering TCP_CLOSE_WAIT,
the deadlock described in this commit is no longer possible.
Instead, the resulting call to xs_tcp_shutdown() can interfere
with pending reconnection attempts.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Clear the connect flag when socket state is TCP_CLOSE_WAIT

2012-10-30T23:26:56+00:00

commit d0bea455dd48da1ecbd04fedf00eb89437455fdc upstream.

This is needed to ensure that we call xprt_connect() upon the next
call to call_connect().

Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Ben Hutchings

SUNRPC: Prevent kernel stack corruption on long values of flush

2012-10-30T23:26:49+00:00

commit 212ba90696ab4884e2025b0b13726d67aadc2cd4 upstream.

The buffer size in read_flush() is too small for the longest possible values
for it. This can lead to a kernel stack corruption:

[   43.047329] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff833e64b4
[   43.047329]
[   43.049030] Pid: 6015, comm: trinity-child18 Tainted: G        W    3.5.0-rc7-next-20120716-sasha #221
[   43.050038] Call Trace:
[   43.050435]  [] panic+0xcd/0x1f4
[   43.050931]  [] ? read_flush.isra.7+0xe4/0x100
[   43.051602]  [] __stack_chk_fail+0x16/0x20
[   43.052206]  [] read_flush.isra.7+0xe4/0x100
[   43.052951]  [] ? read_flush_pipefs+0x30/0x30
[   43.053594]  [] read_flush_procfs+0x2c/0x30
[   43.053596]  [] proc_reg_read+0x9c/0xd0
[   43.053596]  [] ? proc_reg_write+0xd0/0xd0
[   43.053596]  [] do_loop_readv_writev+0x4b/0x90
[   43.053596]  [] do_readv_writev+0xf6/0x1d0
[   43.053596]  [] vfs_readv+0x3e/0x60
[   43.053596]  [] sys_readv+0x48/0xb0
[   43.053596]  [] system_call_fastpath+0x1a/0x1f

Signed-off-by: Sasha Levin 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Ben Hutchings

SUNRPC: Set alloc_slot for backchannel tcp ops

2012-10-30T23:26:29+00:00

commit 84e28a307e376f271505af65a7b7e212dd6f61f4 upstream.

f39c1bfb5a03e2d255451bff05be0d7255298fa4 (SUNRPC: Fix a UDP transport
regression) introduced the "alloc_slot" function for xprt operations,
but never created one for the backchannel operations.  This patch fixes
a null pointer dereference when mounting NFS over v4.1.

Call Trace:
 [] ? xprt_reserve+0x47/0x50 [sunrpc]
 [] call_reserve+0x34/0x60 [sunrpc]
 [] __rpc_execute+0x90/0x400 [sunrpc]
 [] rpc_async_schedule+0x2a/0x40 [sunrpc]
 [] process_one_work+0x139/0x500
 [] ? alloc_worker+0x70/0x70
 [] ? __rpc_execute+0x400/0x400 [sunrpc]
 [] worker_thread+0x15e/0x460
 [] ? preempt_schedule+0x49/0x70
 [] ? rescuer_thread+0x230/0x230
 [] kthread+0x93/0xa0
 [] kernel_thread_helper+0x4/0x10
 [] ? kthread_freezable_should_stop+0x70/0x70
 [] ? gs_change+0x13/0x13

Signed-off-by: Bryan Schumaker 
Signed-off-by: Trond Myklebust 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings