linux-toradex.git/fs/nfs/pnfs.c, branch v4.4.95

NFS: Fix 2 use after free issues in the I/O code

2017-09-13T21:09:46+00:00

commit 196639ebbe63a037fe9a80669140bd292d8bcd80 upstream.

The writeback code wants to send a commit after processing the pages,
which is why we want to delay releasing the struct path until after
that's done.

Also, the layout code expects that we do not free the inode before
we've put the layout segments in pnfs_writehdr_free() and
pnfs_readhdr_free()

Fixes: 919e3bd9a875 ("NFS: Ensure we commit after writeback is complete")
Fixes: 4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup")
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

pNFS: Fix race in pnfs_wait_on_layoutreturn

2017-01-19T19:17:22+00:00

commit ee284e35d8c71bf5d4d807eaff6f67a17134b359 upstream.

We must put the task to sleep while holding the inode->i_lock in order
to ensure atomicity with the test for NFS_LAYOUT_RETURN.

Fixes: 500d701f336b ("NFS41: make close wait for layoutreturn")
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

pNFS: Ensure LAYOUTGET and LAYOUTRETURN are properly serialised

2016-09-24T08:07:36+00:00

commit bf0291dd2267a2b9a4cd74d65249553d11bb45d6 upstream.

According to RFC5661, the client is responsible for serialising
LAYOUTGET and LAYOUTRETURN to avoid ambiguity. Consider the case
where we send both in parallel.

Client					Server
======					======
LAYOUTGET(seqid=X)
LAYOUTRETURN(seqid=X)
					LAYOUTGET return seqid=X+1
					LAYOUTRETURN return seqid=X+2
Process LAYOUTRETURN
          Forget layout stateid
Process LAYOUTGET
          Set seqid=X+1

The client processes the layoutget/layoutreturn in the wrong order,
and since the result of the layoutreturn was to clear the only
existing layout segment, the client forgets the layout stateid.

When the LAYOUTGET comes in, it is treated as having a completely
new stateid, and so the client sets the wrong sequence id...

Fix is to check if there are outstanding LAYOUTGET requests
before we send the LAYOUTRETURN (note that LAYOUGET will already
wait if it sees an outstanding LAYOUTRETURN).

Signed-off-by: Trond Myklebust 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

pNFS: The client must not do I/O to the DS if it's lease has expired

2016-09-24T08:07:36+00:00

commit b88fa69eaa8649f11828158c7b65c4bcd886ebd5 upstream.

Ensure that the client conforms to the normative behaviour described in
RFC5661 Section 12.7.2: "If a client believes its lease has expired,
it MUST NOT send I/O to the storage device until it has validated its
lease."

So ensure that we wait for the lease to be validated before using
the layout.

Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

sched/wait: Fix the signal handling fix

2015-12-13T22:30:59+00:00

Jan Stancek reported that I wrecked things for him by fixing things for
Vladimir :/

His report was due to an UNINTERRUPTIBLE wait getting -EINTR, which
should not be possible, however my previous patch made this possible by
unconditionally checking signal_pending().

We cannot use current->state as was done previously, because the
instruction after the store to that variable it can be changed.  We must
instead pass the initial state along and use that.

Fixes: 68985633bccb ("sched/wait: Fix signal handling in bit wait helpers")
Reported-by: Jan Stancek 
Reported-by: Chris Mason 
Tested-by: Jan Stancek 
Tested-by: Vladimir Murzin 
Tested-by: Chris Mason 
Reviewed-by: Paul Turner 
Cc: Ingo Molnar 
Cc: tglx@linutronix.de
Cc: Oleg Nesterov 
Cc: hpa@zytor.com
Signed-off-by: Peter Zijlstra (Intel) 
Signed-off-by: Linus Torvalds

nfs4: resend LAYOUTGET when there is a race that changes the seqid

2015-11-25T20:32:13+00:00

pnfs_layout_process will check the returned layout stateid against what
the kernel has in-core. If it turns out that the stateid we received is
older, then we should resend the LAYOUTGET instead of falling back to
MDS I/O.

Signed-off-by: Jeff Layton 
Cc: stable@vger.kernel.org # 3.18+
Signed-off-by: Trond Myklebust

NFSv4.1/pnfs: Retry through MDS when getting bad length of data

2015-10-21T20:55:47+00:00

If non rpc-based layout driver return bad length of data, nfs retries
by calling rpc_restart_call_prepare() that cause an NULL reference panic.

This patch lets nfs retry through MDS for non rpc-based layout driver
return bad length of data.

[13034.883329] BUG: unable to handle kernel NULL pointer dereference at           (null)
[13034.884902] IP: [] rpc_restart_call_prepare+0x62/0x90 [sunrpc]
[13034.886558] PGD 0
[13034.888126] Oops: 0000 [#1] KASAN
[13034.889710] Modules linked in: blocklayoutdriver(OE) nfsv4(OE) nfs(OE) fscache(E) nfsd(OE) xfs libcrc32c coretemp btrfs crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ppdev vmw_balloon auth_rpcgss shpchp nfs_acl lockd vmw_vmci parport_pc xor raid6_pq grace parport sunrpc i2c_piix4 vmwgfx drm_kms_helper ttm drm mptspi e1000 serio_raw scsi_transport_spi mptscsih mptbase ata_generic pata_acpi [last unloaded: fscache]
[13034.898260] CPU: 0 PID: 10112 Comm: kworker/0:1 Tainted: G           OE   4.3.0-rc5+ #279
[13034.899932] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
[13034.903342] Workqueue: events bl_read_cleanup [blocklayoutdriver]
[13034.905059] task: ffff88006a9148c0 ti: ffff880035e90000 task.ti: ffff880035e90000
[13034.906827] RIP: 0010:[]  [] rpc_restart_call_prepare+0x62/0x90 [sunrpc]
[13034.910522] RSP: 0018:ffff880035e97b58  EFLAGS: 00010282
[13034.912378] RAX: fffffbfff04a5a94 RBX: ffff880068fe4858 RCX: 0000000000000003
[13034.914339] RDX: dffffc0000000000 RSI: 0000000000000003 RDI: 0000000000000282
[13034.916236] RBP: ffff880035e97b68 R08: 0000000000000001 R09: 0000000000000001
[13034.918229] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[13034.920007] R13: ffff880068fe4858 R14: ffff880068fe4a60 R15: 0000000000001000
[13034.921845] FS:  0000000000000000(0000) GS:ffffffff82247000(0000) knlGS:0000000000000000
[13034.923645] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[13034.925525] CR2: 0000000000000000 CR3: 00000000063dd000 CR4: 00000000001406f0
[13034.932808] Stack:
[13034.934813]  ffff880068fe4780 0000000000001000 ffff880035e97ba8 ffffffffa08800d2
[13034.936675]  ffffffffa088029d ffff880068fe4780 ffff880068fe4858 ffffffffa089c0a0
[13034.938593]  ffff880068fe47e0 ffff88005d59faf0 ffff880035e97be0 ffffffffa087e08f
[13034.940454] Call Trace:
[13034.942388]  [] nfs_readpage_result+0x112/0x200 [nfs]
[13034.944317]  [] ? nfs_readpage_done+0xdd/0x160 [nfs]
[13034.946267]  [] nfs_pgio_result+0x9f/0x120 [nfs]
[13034.948166]  [] pnfs_ld_read_done+0x7c/0x1e0 [nfsv4]
[13034.950247]  [] bl_read_cleanup+0x2e/0x60 [blocklayoutdriver]
[13034.952156]  [] process_one_work+0x412/0x870
[13034.954102]  [] ? process_one_work+0x334/0x870
[13034.955949]  [] ? queue_delayed_work_on+0x40/0x40
[13034.957985]  [] worker_thread+0x81/0x6a0
[13034.959817]  [] ? process_one_work+0x870/0x870
[13034.961785]  [] kthread+0x17d/0x1a0
[13034.963544]  [] ? kthread_create_on_node+0x330/0x330
[13034.965479]  [] ? finish_task_switch+0x88/0x220
[13034.967223]  [] ? kthread_create_on_node+0x330/0x330
[13034.968929]  [] ret_from_fork+0x3f/0x70
[13034.970534]  [] ? kthread_create_on_node+0x330/0x330
[13034.972176] Code: c7 43 50 40 84 0d a0 e8 3d fe 1c e1 48 8d 7b 58 c7 83 e4 00 00 00 00 00 00 00 e8 ca fe 1c e1 4c 8b 63 58 4c 89 e7 e8 be fe 1c e1 <49> 83 3c 24 00 74 12 48 c7 43 50 f0 a2 0e a0 b8 01 00 00 00 5b
[13034.977148] RIP  [] rpc_restart_call_prepare+0x62/0x90 [sunrpc]
[13034.978780]  RSP 
[13034.980399] CR2: 0000000000000000

Signed-off-by: Kinglong Mee 
Signed-off-by: Trond Myklebust

NFS41: make close wait for layoutreturn

2015-09-23T12:55:32+00:00

If we send a layoutreturn asynchronously before close, the close
might reach server first and layoutreturn would fail with BADSTATEID
because there is nothing keeping the layout stateid alive.

Also do not pretend sending layoutreturn if we are not.

Signed-off-by: Peng Tao 
Signed-off-by: Trond Myklebust

NFSv4.1/pNFS: Don't request a minimal read layout beyond the end of file

2015-08-31T09:05:47+00:00

If we have a read layout, then sanity check the minimal layout length
so that it does not extend beyond the end of file.

Signed-off-by: Trond Myklebust

NFSv4.1/pnfs: Don't ask for a read layout for an empty file.

2015-08-31T08:33:12+00:00

Signed-off-by: Trond Myklebust