linux-stable.git/net/sunrpc, branch v3.4.113

SUNRPC: xs_reset_transport must mark the connection as disconnected

2016-04-27T10:55:16+00:00

commit 0c78789e3a030615c6650fde89546cadf40ec2cc upstream.

In case the reconnection attempt fails.

Signed-off-by: Trond Myklebust 
[lizf: Backported to 3.4: add definition of variable xprt]
Signed-off-by: Zefan Li

svcrdma: Fix send_reply() scatter/gather set-up

2016-04-27T10:55:14+00:00

commit 9d11b51ce7c150a69e761e30518f294fc73d55ff upstream.

The Linux NFS server returns garbage in the data payload of inline
NFS/RDMA READ replies. These are READs of under 1000 bytes or so
where the client has not provided either a reply chunk or a write
list.

The NFS server delivers the data payload for an NFS READ reply to
the transport in an xdr_buf page list. If the NFS client did not
provide a reply chunk or a write list, send_reply() is supposed to
set up a separate sge for the page containing the READ data, and
another sge for XDR padding if needed, then post all of the sges via
a single SEND Work Request.

The problem is send_reply() does not advance through the xdr_buf
when setting up scatter/gather entries for SEND WR. It always calls
dma_map_xdr with xdr_off set to zero. When there's more than one
sge, dma_map_xdr() sets up the SEND sge's so they all point to the
xdr_buf's head.

The current Linux NFS/RDMA client always provides a reply chunk or
a write list when performing an NFS READ over RDMA. Therefore, it
does not exercise this particular case. The Linux server has never
had to use more than one extra sge for building RPC/RDMA replies
with a Linux client.

However, an NFS/RDMA client _is_ allowed to send small NFS READs
without setting up a write list or reply chunk. The NFS READ reply
fits entirely within the inline reply buffer in this case. This is
perhaps a more efficient way of performing NFS READs that the Linux
NFS/RDMA client may some day adopt.

Fixes: b432e6b3d9c1 ('svcrdma: Change DMA mapping logic to . . .')
BugLink: https://bugzilla.linux-nfs.org/show_bug.cgi?id=285
Signed-off-by: Chuck Lever 
Signed-off-by: J. Bruce Fields 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

SUNRPC: never enqueue a ->rq_cong request on ->sending

2016-03-21T01:17:56+00:00

commit 298073181112a6ab6c30fe7971b99de968daf81e upstream.

If the sending queue has a task without ->rq_cong set at the front,
and then a number of tasks with ->rq_cong set such that they use
the entire congestion window, then the queue deadlocks.  The first
entry cannot be processed until later entries complete.

This scenario has been seen with a client using UDP to access a server,
and the network connection breaking for a period of time - it doesn't
recover.

It never really makes sense for an ->rq_cong request to be on the ->sending
queue, but it can happen when a request is being retried, and finds
the transport if locked (XPRT_LOCKED).  In this case we simple call
__xprt_put_cong() and the deadlock goes away.

Signed-off-by: NeilBrown 
Signed-off-by: Trond Myklebust 
Signed-off-by: Zefan Li

SUNRPC: Fix a memory leak in the backchannel code

2015-10-22T01:20:03+00:00

commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.

req->rq_private_buf isn't initialised when xprt_setup_backchannel calls
xprt_free_allocation.

Fixes: fb7a0b9addbdb ("nfs41: New backchannel helper routines")
Signed-off-by: Trond Myklebust 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

sunrpc: fix braino in ->poll()

2015-06-19T03:40:22+00:00

commit 1711fd9addf214823b993468567cab1f8254fc51 upstream.

POLL_OUT isn't what callers of ->poll() are expecting to see; it's
actually __SI_POLL | 2 and it's a siginfo code, not a poll bitmap
bit...

Signed-off-by: Al Viro 
Cc: Bruce Fields 
Signed-off-by: Linus Torvalds 
Signed-off-by: Zefan Li

xprtrdma: Free the pd if ib_query_qp() fails

2015-06-19T03:40:13+00:00

commit 5ae711a24601257f395c1f8746ac95be0cbd75e5 upstream.

If ib_query_qp() fails or the memory registration mode isn't
supported, don't leak the PD. An orphaned IB/core resource will
cause IB module removal to hang.

Fixes: bd7ed1d13304 ("RPC/RDMA: check selected memory registration ...")
Signed-off-by: Chuck Lever 
Reviewed-by: Steve Wise 
Signed-off-by: Anna Schumaker 
[lizf: Backported to 3.4: only two goto statements need to be changed]
Signed-off-by: Zefan Li

SUNRPC: Fix locking around callback channel reply receive

2015-04-14T09:33:36+00:00

commit 093a1468b6edb0e568be7311b8d2228d205702db upstream.

Both xprt_lookup_rqst() and xprt_complete_rqst() require that you
take the transport lock in order to avoid races with xprt_transmit().

Signed-off-by: Trond Myklebust 
Reviewed-by: Jeff Layton 
Signed-off-by: J. Bruce Fields 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

nfsd: check passed socket's net matches NFSd superblock's one

2014-06-11T19:04:19+00:00

commit 3064639423c48d6e0eb9ecc27c512a58e38c6c57 upstream.

There could be a case, when NFSd file system is mounted in network, different
to socket's one, like below:

"ip netns exec" creates new network and mount namespace, which duplicates NFSd
mount point, created in init_net context. And thus NFS server stop in nested
network context leads to RPCBIND client destruction in init_net.
Then, on NFSd start in nested network context, rpc.nfsd process creates socket
in nested net and passes it into "write_ports", which leads to RPCBIND sockets
creation in init_net context because of the same reason (NFSd monut point was
created in init_net context). An attempt to register passed socket in nested
net leads to panic, because no RPCBIND client present in nexted network
namespace.

This patch add check that passed socket's net matches NFSd superblock's one.
And returns -EINVAL error to user psace otherwise.

v2: Put socket on exit.

Reported-by: Weng Meiling 
Signed-off-by: Stanislav Kinsbursky 
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields 
[wengmeiling: backport to 3.4: adjust context]
Signed-off-by: Weng Meiling 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Prevent an rpc_task wakeup race

2014-03-11T23:10:08+00:00

commit a3c3cac5d31879cd9ae2de7874dc6544ca704aec upstream.

The lockless RPC_IS_QUEUED() test in __rpc_execute means that we need to
be careful about ordering the calls to rpc_test_and_set_running(task) and
rpc_clear_queued(task). If we get the order wrong, then we may end up
testing the RPC_TASK_RUNNING flag after __rpc_execute() has looped
and changed the state of the rpc_task.

Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings 
Cc: Weng Meiling 
Signed-off-by: Greg Kroah-Hartman

sunrpc: clarify comments on rpc_make_runnable

2014-03-11T23:10:07+00:00

commit 506026c3ec270e18402f0c9d33fee37482c23861 upstream.

rpc_make_runnable is not generally called with the queue lock held, unless
it's waking up a task that has been sitting on a waitqueue. This is safe
when the task has not entered the FSM yet, but the comments don't really
spell this out.

Signed-off-by: Jeff Layton 
Signed-off-by: Trond Myklebust 
Signed-off-by: Ben Hutchings 
Cc: Weng Meiling 
Signed-off-by: Greg Kroah-Hartman