On Sun, 2025-01-26 at 13:39 +1100, NeilBrown wrote: > On Sun, 26 Jan 2025, Jeff Layton wrote: > > nfsd_file_dispose_list_delayed can be called from the filecache > > laundrette, which is shut down after the nfsd threads are shut down and > > the nfsd_serv pointer is cleared. If nn->nfsd_serv is NULL then there > > are no threads to wake. > > > > Ensure that the nn->nfsd_serv pointer is non-NULL before calling > > svc_wake_up in nfsd_file_dispose_list_delayed. This is safe since the > > svc_serv is not freed until after the filecache laundrette is cancelled. > > > > Fixes: ffb402596147 ("nfsd: Don't leave work of closing files to a work queue") > > Reported-by: Salvatore Bonaccorso <carnil@xxxxxxxxxx> > > Closes: https://lore.kernel.org/linux-nfs/7d9f2a8aede4f7ca9935a47e1d405643220d7946.camel@xxxxxxxxxx/ > > Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx> > > --- > > This is only lightly tested, but I think it will fix the bug that > > Salvatore reported. > > --- > > fs/nfsd/filecache.c | 11 ++++++++++- > > 1 file changed, 10 insertions(+), 1 deletion(-) > > > > diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c > > index e91c164b5ea21507659904690533a19ca43b1b64..fb2a4469b7a3c077de2dd750f43239b4af6d37b0 100644 > > --- a/fs/nfsd/filecache.c > > +++ b/fs/nfsd/filecache.c > > @@ -445,11 +445,20 @@ nfsd_file_dispose_list_delayed(struct list_head *dispose) > > struct nfsd_file, nf_gc); > > struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id); > > struct nfsd_fcache_disposal *l = nn->fcache_disposal; > > + struct svc_serv *serv; > > > > spin_lock(&l->lock); > > list_move_tail(&nf->nf_gc, &l->freeme); > > spin_unlock(&l->lock); > > - svc_wake_up(nn->nfsd_serv); > > + > > + /* > > + * The filecache laundrette is shut down after the > > + * nn->nfsd_serv pointer is cleared, but before the > > + * svc_serv is freed. > > + */ > > + serv = nn->nfsd_serv; > > I wonder if this should be READ_ONCE() to tell the compiler that we > could race with clearing nn->nfsd_serv. Would the comment still be > needed? > I think we need a comment at least. The linkage between the laundrette and the nfsd_serv being set to NULL is very subtle. A READ_ONCE() doesn't convey that well, and is unnecessary here. > Otherwise: > > Reviewed-by: NeilBrown <neilb@xxxxxxx> > Thanks! > > > + if (serv) > > + svc_wake_up(serv); > > } > > } > > > > > > --- > > base-commit: 7541a5b8073cf0d9e2d288cac581f1aa6c11671d > > change-id: 20250125-kdevops-0989825ae8db > > > > Best regards, > > -- > > Jeff Layton <jlayton@xxxxxxxxxx> > > > > > -- Jeff Layton <jlayton@xxxxxxxxxx>