linux-toradex.git/fs/nfs, branch v4.2.4

nfs/filelayout: Fix NULL reference caused by double freeing of fh_array

2015-10-22T21:49:33+00:00

commit 3ec0c97959abff33a42db9081c22132bcff5b4f2 upstream.

If filelayout_decode_layout fail, _filelayout_free_lseg will causes
a double freeing of fh_array.

[ 1179.279800] BUG: unable to handle kernel NULL pointer dereference at           (null)
[ 1179.280198] IP: [] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
[ 1179.281010] PGD 0
[ 1179.281443] Oops: 0000 [#1]
[ 1179.281831] Modules linked in: nfs_layout_nfsv41_files(OE) nfsv4(OE) nfs(OE) fscache(E) xfs libcrc32c coretemp nfsd crct10dif_pclmul ppdev crc32_pclmul crc32c_intel auth_rpcgss ghash_clmulni_intel nfs_acl lockd vmw_balloon grace sunrpc parport_pc vmw_vmci parport shpchp i2c_piix4 vmwgfx drm_kms_helper ttm drm serio_raw mptspi scsi_transport_spi mptscsih e1000 mptbase ata_generic pata_acpi [last unloaded: fscache]
[ 1179.283891] CPU: 0 PID: 13336 Comm: cat Tainted: G           OE   4.3.0-rc1-pnfs+ #244
[ 1179.284323] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
[ 1179.285206] task: ffff8800501d48c0 ti: ffff88003e3c4000 task.ti: ffff88003e3c4000
[ 1179.285668] RIP: 0010:[]  [] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
[ 1179.286612] RSP: 0018:ffff88003e3c77f8  EFLAGS: 00010202
[ 1179.287092] RAX: 0000000000000000 RBX: ffff88001fe78900 RCX: 0000000000000000
[ 1179.287731] RDX: ffffea0000f40760 RSI: ffff88001fe789c8 RDI: ffff88001fe789c0
[ 1179.288383] RBP: ffff88003e3c7810 R08: ffffea0000f40760 R09: 0000000000000000
[ 1179.289170] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88001fe789c8
[ 1179.289959] R13: ffff88001fe789c0 R14: ffff88004ec05a80 R15: ffff88004f935b88
[ 1179.290791] FS:  00007f4e66bb5700(0000) GS:ffffffff81c29000(0000) knlGS:0000000000000000
[ 1179.291580] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1179.292209] CR2: 0000000000000000 CR3: 00000000203f8000 CR4: 00000000001406f0
[ 1179.292731] Stack:
[ 1179.293195]  ffff88001fe78900 00000000000000d0 ffff88001fe78178 ffff88003e3c7868
[ 1179.293676]  ffffffffa0272737 0000000000000001 0000000000000001 ffff88001fe78800
[ 1179.294151]  00000000614fffce ffffffff81727671 ffff88001fe78100 ffff88001fe78100
[ 1179.294623] Call Trace:
[ 1179.295092]  [] filelayout_alloc_lseg+0xa7/0x2d0 [nfs_layout_nfsv41_files]
[ 1179.295625]  [] ? out_of_line_wait_on_bit+0x81/0xb0
[ 1179.296133]  [] pnfs_layout_process+0xae/0x320 [nfsv4]
[ 1179.296632]  [] nfs4_proc_layoutget+0x2b1/0x360 [nfsv4]
[ 1179.297134]  [] pnfs_update_layout+0x853/0xb30 [nfsv4]
[ 1179.297632]  [] ? nfs_get_lock_context+0x74/0x170 [nfs]
[ 1179.298158]  [] filelayout_pg_init_read+0x37/0x50 [nfs_layout_nfsv41_files]
[ 1179.298834]  [] __nfs_pageio_add_request+0x119/0x460 [nfs]
[ 1179.299385]  [] ? nfs_create_request.part.9+0x37/0x2e0 [nfs]
[ 1179.299872]  [] nfs_pageio_add_request+0xa3/0x1b0 [nfs]
[ 1179.300362]  [] readpage_async_filler+0x85/0x260 [nfs]
[ 1179.300907]  [] read_cache_pages+0x91/0xd0
[ 1179.301391]  [] ? nfs_read_completion+0x220/0x220 [nfs]
[ 1179.301867]  [] nfs_readpages+0x128/0x200 [nfs]
[ 1179.302330]  [] __do_page_cache_readahead+0x203/0x280
[ 1179.302784]  [] ? __do_page_cache_readahead+0xd8/0x280
[ 1179.303413]  [] ondemand_readahead+0x1a6/0x2f0
[ 1179.303855]  [] page_cache_sync_readahead+0x31/0x50
[ 1179.304286]  [] generic_file_read_iter+0x4a6/0x5c0
[ 1179.304711]  [] ? __nfs_revalidate_mapping+0x1f6/0x240 [nfs]
[ 1179.305132]  [] nfs_file_read+0x52/0xa0 [nfs]
[ 1179.305540]  [] __vfs_read+0xcc/0x100
[ 1179.305936]  [] vfs_read+0x85/0x130
[ 1179.306326]  [] SyS_read+0x58/0xd0
[ 1179.306708]  [] entry_SYSCALL_64_fastpath+0x12/0x76
[ 1179.307094] Code: c4 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 8b 07 49 89 f4 85 c0 74 47 48 8b 06 49 89 fd <48> 8b 38 48 85 ff 74 22 31 db eb 0c 48 63 d3 48 8b 3c d0 48 85
[ 1179.308357] RIP  [] filelayout_free_fh_array.isra.11+0x1d/0x70 [nfs_layout_nfsv41_files]
[ 1179.309177]  RSP 
[ 1179.309582] CR2: 0000000000000000

Signed-off-by: Kinglong Mee 
Signed-off-by: Trond Myklebust 
Cc: William Dauchy 
Signed-off-by: Greg Kroah-Hartman

NFS: Fix a write performance regression

2015-10-22T21:49:24+00:00

commit 8fa4592a14ebb3c22a21d846d1e4f65dab7d1a7c upstream.

If all other conditions in nfs_can_extend_write() are met, and there
are no locks, then we should be able to assume close-to-open semantics
and the ability to extend our write to cover the whole page.

With this patch, the xfstests generic/074 test completes in 242s instead
of >1400s on my test rig.

Fixes: bd61e0a9c852 ("locks: convert posix locks to file_lock_context")
Cc: Jeff Layton 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

nfs: fix pg_test page count calculation

2015-10-22T21:49:24+00:00

commit 048883e0b934d9a5103d40e209cb14b7f33d2933 upstream.

We really want sizeof(struct page *) instead. Otherwise we limit
maximum IO size to 64 pages rather than 512 pages on a 64bit system.

Fixes 2e11f829(nfs: cap request size to fit a kmalloced page array).

Cc: Christoph Hellwig 
Signed-off-by: Peng Tao 
Fixes: 2e11f8296d22 ("nfs: cap request size to fit a kmalloced page array")
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFSv4: Recovery of recalled read delegations is broken

2015-10-22T21:49:24+00:00

commit 24311f884189d42d40354a6f38ca218eb9aeb811 upstream.

When a read delegation is being recalled, and we're reclaiming the
cached opens, we need to make sure that we only reclaim read-only
modes.
A previous attempt to do this, relied on retrieving the delegation
type from the nfs4_opendata structure. Unfortunately, as Kinglong
pointed out, this field can only be set when performing reboot recovery.

Furthermore, if we call nfs4_open_recover(), then we end up clobbering
the state->flags for all modes that we're not recovering...

The fix is to have the delegation recall code pass this information
to the recovery call, and then refactor the recovery code so that
nfs4_open_delegation_recall() does not need to call nfs4_open_recover().

Reported-by: Kinglong Mee 
Fixes: 39f897fdbd46 ("NFSv4: When returning a delegation, don't...")
Tested-by: Kinglong Mee 
Cc: NeilBrown 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFS: Do cleanup before resetting pageio read/write to mds

2015-10-22T21:49:24+00:00

commit 6f29b9bba7b08c6b1d6f2cc4cf750b342fc1946c upstream.

There is a reference leak of layout segment after resetting
pageio read/write to mds.

Signed-off-by: Kinglong Mee 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

nfs: fix v4.2 SEEK on files over 2 gigs

2015-10-22T21:49:24+00:00

commit 306a5549355966e480e0dcacdc6b9321d153e0c0 upstream.

We're incorrectly assigning a loff_t return to an int.  If SEEK_HOLE or
SEEK_DATA returns an offset over 2^31 then the application will see a
weird lseek() result (usually -EIO).

Fixes: bdcc2cd14e4e "NFSv4.2: handle NFS-specific llseek errors"
Signed-off-by: J. Bruce Fields 
Reviewed-by: Anna Schumaker 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

Revert "NFSv4: Remove incorrect check in can_open_delegated()"

2015-09-29T17:33:30+00:00

commit 36319608e28701c07cad80ae3be8b0fdfb1ab40f upstream.

This reverts commit 4e379d36c050b0117b5d10048be63a44f5036115.

This commit opens up a race between the recovery code and the open code.

Reported-by: Olga Kornievskaia 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

nfs: Fix truncated client owner id without proto type

2015-09-29T17:33:30+00:00

commit 4a70316caef7d158445e672e146eb9f1b8c1aeee upstream.

The length of "Linux NFSv4.0 " is 14, not 10.

Without this patch, I get a truncated client owner id as,
"Linux NFSv4.0 ::1/::1"

With this patch,
"Linux NFSv4.0 ::1/::1 tcp"

Fixes: a319268891 ("nfs: make nfs4_init_nonuniform_client_string use a dynamically allocated buffer")
Signed-off-by: Kinglong Mee 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFSv4.1: Fix a protocol issue with CLOSE stateids

2015-09-29T17:33:29+00:00

commit 4a1e2feb9d246775dee0f78ed5b18826bae2b1c5 upstream.

According to RFC5661 Section 18.2.4, CLOSE is supposed to return
the zero stateid. This means that nfs_clear_open_stateid_locked()
cannot assume that the result stateid will always match the 'other'
field of the existing open stateid when trying to determine a race
with a parallel OPEN.

Instead, we look at the argument, and check for matches.

Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFSv4.1/flexfiles: Fix a protocol error in layoutreturn

2015-09-29T17:33:29+00:00

commit d13549074cf066d6d5bb29903d044beffea342d3 upstream.

According to the flexfiles protocol, the layoutreturn should specify an
array of errors in the following format:

struct ff_ioerr4 {
	offset4        ffie_offset;
	length4        ffie_length;
	stateid4       ffie_stateid;
	device_error4  ffie_errors<>;
};

This patch fixes up the code to ensure that our ffie_errors is indeed
encoded as an array (albeit with only a single entry).

Reported-by: Tom Haynes 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman