github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-27 11:02:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Browse Source 
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
list_for_each_entry_safe(ni, tmp, ...).  For each expired entry it
sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
source vfsmount, then reacquires the lock to list_del + kfree the
entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent
nfsd4_ssc_setup_dul() finders during the lock-drop window, but it
does not pin tmp.  Another nfsd RPC thread that fails its source-
server mount and reaches nfsd4_ssc_cancel_dul() will, during that
same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
item, and release the lock.  If that item is the saved tmp of the
expire walk, the next iteration dereferences a freed
nfsd4_ssc_umount_item.

Restart the walk from the head after the mntput() unlock window so
no saved next pointer survives the lock-drop.  The list is bounded
by the number of active inter-server source mounts (typically small)
and the expire delayed-work runs periodically rather than per-IO,
so the restart is cheap.

Fixes: f4e44b3933 ("NFSD: delay unmount source's export after inter-server copy completed.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524130654.1924556-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Michael Bommarito 2026-05-24 09:06:54 -04:00 committed by Chuck Lever
parent 526c49cff3
commit 036c1b182f
1 changed files with 27 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
fs/nfsd/nfs4state.c
View File

@ -6859,30 +6859,36 @@ static void nfsd4_ssc_shutdown_umount(struct nfsd_net *nn)
static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
{
bool do_wakeup = false;
struct nfsd4_ssc_umount_item *ni = NULL;
struct nfsd4_ssc_umount_item *tmp;
struct nfsd4_ssc_umount_item *ni;
restart:
spin_lock(&nn->nfsd_ssc_lock);
list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
if (time_after(jiffies, ni->nsui_expire)) {
if (refcount_read(&ni->nsui_refcnt) > 1)
continue;
/* mark being unmount */
ni->nsui_busy = true;
spin_unlock(&nn->nfsd_ssc_lock);
mntput(ni->nsui_vfsmount);
spin_lock(&nn->nfsd_ssc_lock);
/* waiters need to start from begin of list */
list_del(&ni->nsui_list);
kfree(ni);
/* wakeup ssc_connect waiters */
do_wakeup = true;
list_for_each_entry(ni, &nn->nfsd_ssc_mount_list, nsui_list) {
if (!time_after(jiffies, ni->nsui_expire))
break;
if (refcount_read(&ni->nsui_refcnt) > 1)
continue;
}
break;
/* Prevent concurrent setup during unmount */
ni->nsui_busy = true;
spin_unlock(&nn->nfsd_ssc_lock);
mntput(ni->nsui_vfsmount);
spin_lock(&nn->nfsd_ssc_lock);
/* Force concurrent scanners to restart */
list_del(&ni->nsui_list);
kfree(ni);
/* wakeup ssc_connect waiters */
do_wakeup = true;
/*
* Concurrent nfsd4_ssc_cancel_dul() can free any item
* on the list under nfsd_ssc_lock while mntput() runs
* above. Restart from the head; the list is short and
* the expire worker is periodic, so this is cheap.
*/
spin_unlock(&nn->nfsd_ssc_lock);
goto restart;
}
if (do_wakeup)
wake_up_all(&nn->nfsd_ssc_waitq);