linux-toradex.git/net/sunrpc, branch v3.4.34

SUNRPC: Fix validity issues with rpc_pipefs sb->s_fs_info

2013-01-17T16:50:50+00:00

commit 642fe4d00db56d65060ce2fd4c105884414acb16 upstream.

rpc_kill_sb() must defer calling put_net() until after the notifier
has been called, since most (all?) of the notifier callbacks assume
that sb->s_fs_info points to a valid net namespace. It also must not
call put_net() if the call to rpc_fill_super was unsuccessful.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=48421

Signed-off-by: Trond Myklebust 
Cc: Stanislav Kinsbursky 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Ensure we release the socket write lock if the rpc_task exits early

2013-01-17T16:50:46+00:00

commit 87ed50036b866db2ec2ba16b2a7aec4a2b0b7c39 upstream.

If the rpc_task exits while holding the socket write lock before it has
allocated an rpc slot, then the usual mechanism for releasing the write
lock in xprt_release() is defeated.

The problem occurs if the call to xprt_lock_write() initially fails, so
that the rpc_task is put on the xprt->sending wait queue. If the task
exits after being assigned the lock by __xprt_lock_write_func, but
before it has retried the call to xprt_lock_and_alloc_slot(), then
it calls xprt_release() while holding the write lock, but will
immediately exit due to the test for task->tk_rqstp != NULL.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Ensure that we free the rpc_task after cleanups are done

2013-01-17T16:50:46+00:00

commit c6567ed1402c55e19b012e66a8398baec2a726f3 upstream.

This patch ensures that we free the rpc_task after the cleanup callbacks
are done in order to avoid a deadlock problem that can be triggered if
the callback needs to wait for another workqueue item to complete.

Signed-off-by: Trond Myklebust 
Cc: Weston Andros Adamson 
Cc: Tejun Heo 
Cc: Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: continue run over clients list on PipeFS event instead of break

2013-01-17T16:50:45+00:00

commit cd6c5968582a273561464fe6b1e8cc8214be02df upstream.

There are SUNRPC clients, which program doesn't have pipe_dir_name. These
clients can be skipped on PipeFS events, because nothing have to be created or
destroyed. But instead of breaking in case of such a client was found, search
for suitable client over clients list have to be continued. Otherwise some
clients could not be covered by PipeFS event handler.

Signed-off-by: Stanislav Kinsbursky 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Prevent races in xs_abort_connection()

2012-10-31T17:02:57+00:00

commit 4bc1e68ed6a8b59be8a79eb719be515a55c7bc68 upstream.

The call to xprt_disconnect_done() that is triggered by a successful
connection reset will trigger another automatic wakeup of all tasks
on the xprt->pending rpc_wait_queue. In particular it will cause an
early wake up of the task that called xprt_connect().

All we really want to do here is clear all the socket-specific state
flags, so we split that functionality out of xs_sock_mark_closed()
into a helper that can be called by xs_abort_connection()

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Greg Kroah-Hartman

Revert "SUNRPC: Ensure we close the socket on EPIPE errors too..."

2012-10-31T17:02:57+00:00

commit b9d2bb2ee537424a7f855e1f93eed44eb9ee0854 upstream.

This reverts commit 55420c24a0d4d1fce70ca713f84aa00b6b74a70e.
Now that we clear the connected flag when entering TCP_CLOSE_WAIT,
the deadlock described in this commit is no longer possible.
Instead, the resulting call to xs_tcp_shutdown() can interfere
with pending reconnection attempts.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Clear the connect flag when socket state is TCP_CLOSE_WAIT

2012-10-31T17:02:57+00:00

commit d0bea455dd48da1ecbd04fedf00eb89437455fdc upstream.

This is needed to ensure that we call xprt_connect() upon the next
call to call_connect().

Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Get rid of the xs_error_report socket callback

2012-10-31T17:02:56+00:00

commit f878b657ce8e7d3673afe48110ec208a29e38c4a upstream.

Chris Perl reports that we're seeing races between the wakeup call in
xs_error_report and the connect attempts. Basically, Chris has shown
that in certain circumstances, the call to xs_error_report causes the
rpc_task that is responsible for reconnecting to wake up early, thus
triggering a disconnect and retry.

Since the sk->sk_error_report() calls in the socket layer are always
followed by a tcp_done() in the cases where we care about waking up
the rpc_tasks, just let the state_change callbacks take responsibility
for those wake ups.

Reported-by: Chris Perl 
Signed-off-by: Trond Myklebust 
Tested-by: Chris Perl 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Fix a UDP transport regression

2012-10-28T17:14:13+00:00

commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 and
commit 84e28a307e376f271505af65a7b7e212dd6f61f4 upstream.

Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that
we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing
hangs in the case of NFS over UDP mounts.

Since neither the UDP or the RDMA transport mechanism use dynamic slot
allocation, we can skip grabbing the socket lock for those transports.
Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA
case.

Note that the NFSv4.1 back channel assigns the slot directly
through rpc_run_bc_task, so we can ignore that case.

Reported-by: Dick Streefland 
Signed-off-by: Bryan Schumaker 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Prevent kernel stack corruption on long values of flush

2012-10-28T17:14:13+00:00

commit 212ba90696ab4884e2025b0b13726d67aadc2cd4 upstream.

The buffer size in read_flush() is too small for the longest possible values
for it. This can lead to a kernel stack corruption:

[   43.047329] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff833e64b4
[   43.047329]
[   43.049030] Pid: 6015, comm: trinity-child18 Tainted: G        W    3.5.0-rc7-next-20120716-sasha #221
[   43.050038] Call Trace:
[   43.050435]  [] panic+0xcd/0x1f4
[   43.050931]  [] ? read_flush.isra.7+0xe4/0x100
[   43.051602]  [] __stack_chk_fail+0x16/0x20
[   43.052206]  [] read_flush.isra.7+0xe4/0x100
[   43.052951]  [] ? read_flush_pipefs+0x30/0x30
[   43.053594]  [] read_flush_procfs+0x2c/0x30
[   43.053596]  [] proc_reg_read+0x9c/0xd0
[   43.053596]  [] ? proc_reg_write+0xd0/0xd0
[   43.053596]  [] do_loop_readv_writev+0x4b/0x90
[   43.053596]  [] do_readv_writev+0xf6/0x1d0
[   43.053596]  [] vfs_readv+0x3e/0x60
[   43.053596]  [] sys_readv+0x48/0xb0
[   43.053596]  [] system_call_fastpath+0x1a/0x1f

Signed-off-by: Sasha Levin 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman