Greetings,
Have you fixed this issue [1]? The identical issue on Ubuntu [2] seems
to have been fixed in tag v5.3-rc5, and patch [3] was committed in
v5.5-rc1, so does patch [4](was committed in v5.1-rc7) seem more likely
to fix the issue? Or is there other patch that can fix it?
Thanks,
ChenXiaoSong.
[1] https://lore.kernel.org/all/76C32636621C40EC87811F625761F2AF@alyakaslap/
[2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1840650
[3] 2bbfed98a4d8 nfsd: Fix races between nfsd4_cb_release() and
nfsd4_shutdown_callback()
[4] e6abc8caa6de nfsd: Don't release the callback slot unless it was
actually held
在 2020/6/28 17:07, Alex Lyakas 写道:
I checked the git log, and found 2 commits that might be relevant [1]
and [2], [2] seems more relevant. However, I don't have any evidence
that in my case client was actually being destroyed, causing double
free of a stateid.
Thanks,
Alex.
[1]
commit e6abc8caa6deb14be2a206253f7e1c5e37e9515b
Author: Trond Myklebust <trondmy@xxxxxxxxx>
Date: Fri Apr 5 08:54:37 2019 -0700
nfsd: Don't release the callback slot unless it was actually held
If there are multiple callbacks queued, waiting for the callback
slot when the callback gets shut down, then they all currently
end up acting as if they hold the slot, and call
nfsd4_cb_sequence_done() resulting in interesting side-effects.
In addition, the 'retry_nowait' path in nfsd4_cb_sequence_done()
causes a loop back to nfsd4_cb_prepare() without first freeing the
slot, which causes a deadlock when nfsd41_cb_get_slot() gets called
a second time.
This patch therefore adds a boolean to track whether or not the
callback did pick up the slot, so that it can do the right thing
in these 2 cases.
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxx>
[2]
commit 2bbfed98a4d82ac4e7abfcd4eba40bddfc670b1d
Author: Trond Myklebust <trondmy@xxxxxxxxx>
Date: Wed Oct 23 17:43:18 2019 -0400
nfsd: Fix races between nfsd4_cb_release() and nfsd4_shutdown_callback()
When we're destroying the client lease, and we call
nfsd4_shutdown_callback(), we must ensure that we do not return
before all outstanding callbacks have terminated and have
released their payloads.
Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx>
Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxx>
