2021-06-26 07:45:43

by zhangxiaoxu (A)

Subject: [PATCH 0/2] Fix nfsv4.1 deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()

Zhang Xiaoxu (2):
SUNRPC: Fix the batch tasks count wraparound.
SUNRPC: Should wake up the privileged task firstly.

net/sunrpc/sched.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)

--
2.25.4

2021-06-26 07:45:43

by zhangxiaoxu (A)

Subject: [PATCH 2/2] SUNRPC: Should wake up the privileged task firstly.

When find a task from wait queue to wake up, a non-privileged task may
be found out, rather than the privileged. This maybe lead a deadlock
same as commit dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):

Privileged delegreturn task is queued to privileged list because all
the slots are assigned. If there has no enough slot to wake up the
non-privileged batch tasks(session less than 8 slot), then the privileged
delegreturn task maybe lost waked up because the found out task can't
get slot since the session is on draining.

So we should treate the privileged task as the emergency task, and
execute it as for as we can.

Reported-by: Hulk Robot <[email protected]>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Cc: [email protected]
Signed-off-by: Zhang Xiaoxu <[email protected]>
---
net/sunrpc/sched.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 37cd09574628..e08ce3b791fd 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -591,6 +591,15 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
struct list_head *q;
struct rpc_task *task;

+ /*
+ * Service the privileged queue.
+ */
+ q = &queue->tasks[RPC_NR_PRIORITY - 1];
+ if (queue->maxpriority > RPC_PRIORITY_PRIVILEGED && !list_empty(q)) {
+ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+ goto out;
+ }
+
/*
* Service a batch of tasks from a single owner.
*/
--
2.25.4

2021-06-26 07:45:43

by zhangxiaoxu (A)

Subject: [PATCH 1/2] SUNRPC: Fix the batch tasks count wraparound.

The 'queue->nr' will wraparound from 0 to 255 when only current
priority queue has tasks. This maybe lead a deadlock same as commit
dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):

Privileged delegreturn task is queued to privileged list because all
the slots are assigned. When non-privileged task complete and release
the slot, a non-privileged maybe picked out. It maybe allocate slot
failed when the session on draining.

If the 'queue->nr' has wraparound to 255, and no enough slot to
service it, then the privileged delegreturn will lost to wake up.

So we should avoid the wraparound on 'queue->nr'.

Reported-by: Hulk Robot <[email protected]>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email protected]
Signed-off-by: Zhang Xiaoxu <[email protected]>
---
net/sunrpc/sched.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 39ed0e0afe6d..37cd09574628 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -595,7 +595,8 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
* Service a batch of tasks from a single owner.
*/
q = &queue->tasks[queue->priority];
- if (!list_empty(q) && --queue->nr) {
+ if (!list_empty(q) && queue->nr) {
+ queue->nr -= 1;
task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
goto out;
}
--
2.25.4