kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/fs/nfsd
History
Olga Kornievskaia d7be15a634 NFSD: free copynotify stateid in nfs4_free_ol_stateid() 
commit 4aa17144d5 upstream.

Typically copynotify stateid is freed either when parent's stateid
is being close/freed or in nfsd4_laundromat if the stateid hasn't
been used in a lease period.

However, in case when the server got an OPEN (which created
a parent stateid), followed by a COPY_NOTIFY using that stateid,
followed by a client reboot. New client instance while doing
CREATE_SESSION would force expire previous state of this client.
It leads to the open state being freed thru release_openowner->
nfs4_free_ol_stateid() and it finds that it still has copynotify
stateid associated with it. We currently print a warning and is
triggerred

WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]

This patch, instead, frees the associated copynotify stateid here.

If the parent stateid is freed (without freeing the copynotify
stateids associated with it), it leads to the list corruption
when laundromat ends up freeing the copynotify state later.

[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink
[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G    B   W           6.17.0-rc7+ #22 PREEMPT(voluntary)
[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024
[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]
[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.861182] sp : ffff8000881d7a40
[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200
[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20
[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8
[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000
[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065
[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3
[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000
[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001
[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000
[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d
[ 1626.868167] Call trace:
[ 1626.868382]  __list_del_entry_valid_or_report+0x148/0x200 (P)
[ 1626.868876]  _free_cpntf_state_locked+0xd0/0x268 [nfsd]
[ 1626.869368]  nfs4_laundromat+0x6f8/0x1058 [nfsd]
[ 1626.869813]  laundromat_main+0x24/0x60 [nfsd]
[ 1626.870231]  process_one_work+0x584/0x1050
[ 1626.870595]  worker_thread+0x4c4/0xc60
[ 1626.870893]  kthread+0x2f8/0x398
[ 1626.871146]  ret_from_fork+0x10/0x20
[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)
[ 1626.871892] SMP: stopping secondary CPUs

Reported-by: rtm@csail.mit.edu
Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@oracle.com/T/#t
Fixes: 624322f1ad ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-11-24 10:35:59 +01:00
..
acl.h NFSD: add posix ACLs to struct nfsd_attrs 2022-08-04 10:28:03 -04:00
auth.c nfsd: Pass 'cred' instead of 'rqstp' to some functions. 2024-09-20 19:31:03 -04:00
auth.h nfsd: Pass 'cred' instead of 'rqstp' to some functions. 2024-09-20 19:31:03 -04:00
blocklayout.c NFSD: Fix last write offset handling in layoutcommit 2025-10-23 16:20:41 +02:00
blocklayoutxdr.c NFSD: Implement large extent array support in pNFS 2025-10-23 16:20:41 +02:00
blocklayoutxdr.h NFSD: Implement large extent array support in pNFS 2025-10-23 16:20:41 +02:00
cache.h nfsd: don't allocate the versions array. 2024-09-20 19:29:23 -04:00
current_stateid.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
export.c nfsd: decouple the xprtsec policy check from check_nfsd_access() 2025-10-19 16:34:07 +02:00
export.h nfsd: decouple the xprtsec policy check from check_nfsd_access() 2025-10-19 16:34:07 +02:00
filecache.c nfsd: validate the nfsd_serv pointer before calling svc_wake_up 2025-02-21 14:01:14 +01:00
filecache.h nfs_common: must not hold RCU while calling nfsd_file_put_local 2024-12-05 14:02:27 +01:00
flexfilelayout.c NFSD: Define a proc_layoutcommit for the FlexFiles layout type 2025-10-23 16:20:47 +02:00
flexfilelayoutxdr.c NFSD: Rework encoding and decoding of nfsd4_deviceid 2025-10-23 16:20:40 +02:00
flexfilelayoutxdr.h NFSD: Make @gdev parameter of ->encode_getdeviceinfo a const pointer 2023-10-16 12:44:29 -04:00
idmap.h nfsd: Remove duplicate define of IDMAP_NAMESZ/IDMAP_TYPE_xx 2015-07-20 14:58:46 -04:00
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-04-25 10:47:50 +02:00
localio.c nfs_common: fix race in NFS calls to nfsd_file_put_local() and nfsd_serv_put() 2024-10-03 16:19:43 -04:00
lockd.c nfsd: refine and rename NFSD_MAY_LOCK 2025-10-19 16:34:03 +02:00
Makefile nfsd: add LOCALIO support 2024-09-23 15:03:30 -04:00
netlink.c nfsd: new netlink ops to get/set server pool_mode 2024-07-08 14:10:05 -04:00
netlink.h nfsd: new netlink ops to get/set server pool_mode 2024-07-08 14:10:05 -04:00
netns.h nfsd: don't use sv_nrthreads in connection limiting calculations. 2025-10-19 16:34:03 +02:00
nfs2acl.c nfsd: clear acl_access/acl_default after releasing them 2025-02-21 14:01:13 +01:00
nfs3acl.c nfsd: clear acl_access/acl_default after releasing them 2025-02-21 14:01:13 +01:00
nfs3proc.c nfsd: move error choice for incorrect object types to version-specific code. 2024-09-20 19:31:03 -04:00
nfs3xdr.c nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() 2024-03-01 09:12:33 -05:00
nfs4acl.c nfsd: inherit required unset default acls from effective set 2023-08-29 17:45:22 -04:00
nfs4callback.c NFSD: Fix CB_GETATTR status fix 2025-04-20 10:16:01 +02:00
nfs4idmap.c nfsd: call cache_put if xdr_reserve_space returns NULL 2024-09-20 19:31:03 -04:00
nfs4layouts.c NFSD: Rework encoding and decoding of nfsd4_deviceid 2025-10-23 16:20:40 +02:00
nfs4proc.c NFSD: Fix crash in nfsd4_read_release() 2025-11-13 15:33:54 -05:00
nfs4recover.c nfsd: fix legacy client tracking initialization 2025-04-07 10:08:35 +02:00
nfs4state.c NFSD: free copynotify stateid in nfs4_free_ol_stateid() 2025-11-24 10:35:59 +01:00
nfs4xdr.c NFSD: Skip close replay processing if XDR encoding fails 2025-11-24 10:35:50 +01:00
nfscache.c nfsd: Simplify the allocation of slab caches in nfsd_drc_slab_create 2024-03-01 09:12:24 -05:00
nfsctl.c nfsd: use threads array as-is in netlink interface 2025-06-27 11:11:40 +01:00
nfsd.h nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes 2025-11-24 10:35:59 +01:00
nfsfh.c nfsd: fix refcount leak in nfsd_set_fh_dentry() 2025-11-24 10:35:59 +01:00
nfsfh.h nfs: add missing selections of CONFIG_CRC32 2025-04-25 10:47:50 +02:00
nfsproc.c nfsd: move error choice for incorrect object types to version-specific code. 2024-09-20 19:31:03 -04:00
nfssvc.c nfsd: Initialize ssc before laundromat_work to prevent NULL dereference 2025-06-27 11:11:15 +01:00
nfsxdr.c NFSD: Ensure that xdr_write_pages updates rq_next_page 2023-06-05 09:01:44 -04:00
pnfs.h NFSD: Implement large extent array support in pNFS 2025-10-23 16:20:41 +02:00
state.h nfsd: fix race between laundromat and free_stateid 2024-10-18 16:40:37 -04:00
stats.c nfsd: don't ignore the return code of svc_proc_register() 2025-04-20 10:16:01 +02:00
stats.h nfsd: don't ignore the return code of svc_proc_register() 2025-04-20 10:16:01 +02:00
trace.c NFSD: Add SPDX header for fs/nfsd/trace.c 2020-11-30 13:00:24 -05:00
trace.h nfsd: refine and rename NFSD_MAY_LOCK 2025-10-19 16:34:03 +02:00
vfs.c nfsd: refine and rename NFSD_MAY_LOCK 2025-10-19 16:34:03 +02:00
vfs.h nfsd: refine and rename NFSD_MAY_LOCK 2025-10-19 16:34:03 +02:00
xdr.h NFSD: prevent underflow in nfssvc_decode_writeargs() 2022-03-15 09:35:56 -04:00
xdr3.h nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() 2024-03-01 09:12:33 -05:00
xdr4.h NFSD: Implement large extent array support in pNFS 2025-10-23 16:20:41 +02:00
xdr4cb.h NFSD: add support for CB_GETATTR callback 2024-03-01 09:12:31 -05:00