This is a note to let you know that I've just added the patch titled
NFSv4 fix CLOSE not waiting for direct IO compeletion
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nfsv4-fix-close-not-waiting-for-direct-io-compeletion.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From d03727b248d0dae6199569a8d7b629a681154633 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <olga.kornievskaia@xxxxxxxxx>
Date: Wed, 24 Jun 2020 13:54:08 -0400
Subject: NFSv4 fix CLOSE not waiting for direct IO compeletion
From: Olga Kornievskaia <olga.kornievskaia@xxxxxxxxx>
commit d03727b248d0dae6199569a8d7b629a681154633 upstream.
Figuring out the root case for the REMOVE/CLOSE race and
suggesting the solution was done by Neil Brown.
Currently what happens is that direct IO calls hold a reference
on the open context which is decremented as an asynchronous task
in the nfs_direct_complete(). Before reference is decremented,
control is returned to the application which is free to close the
file. When close is being processed, it decrements its reference
on the open_context but since directIO still holds one, it doesn't
sent a close on the wire. It returns control to the application
which is free to do other operations. For instance, it can delete a
file. Direct IO is finally releasing its reference and triggering
an asynchronous close. Which races with the REMOVE. On the server,
REMOVE can be processed before the CLOSE, failing the REMOVE with
EACCES as the file is still opened.
Signed-off-by: Olga Kornievskaia <kolga@xxxxxxxxxx>
Suggested-by: Neil Brown <neilb@xxxxxxxx>
CC: stable@xxxxxxxxxxxxxxx
Signed-off-by: Anna Schumaker <Anna.Schumaker@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/nfs/direct.c | 13 +++++++++----
fs/nfs/file.c | 1 +
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -379,8 +379,6 @@ static void nfs_direct_complete(struct n
{
struct inode *inode = dreq->inode;
- inode_dio_end(inode);
-
if (dreq->iocb) {
long res = (long) dreq->error;
if (dreq->count != 0) {
@@ -392,7 +390,10 @@ static void nfs_direct_complete(struct n
complete(&dreq->completion);
+ igrab(inode);
nfs_direct_req_release(dreq);
+ inode_dio_end(inode);
+ iput(inode);
}
static void nfs_direct_readpage_release(struct nfs_page *req)
@@ -534,8 +535,10 @@ static ssize_t nfs_direct_read_schedule_
* generic layer handle the completion.
*/
if (requested_bytes == 0) {
- inode_dio_end(inode);
+ igrab(inode);
nfs_direct_req_release(dreq);
+ inode_dio_end(inode);
+ iput(inode);
return result < 0 ? result : -EIO;
}
@@ -953,8 +956,10 @@ static ssize_t nfs_direct_write_schedule
* generic layer handle the completion.
*/
if (requested_bytes == 0) {
- inode_dio_end(inode);
+ igrab(inode);
nfs_direct_req_release(dreq);
+ inode_dio_end(inode);
+ iput(inode);
return result < 0 ? result : -EIO;
}
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, st
dprintk("NFS: release(%pD2)\n", filp);
nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
+ inode_dio_wait(inode);
nfs_file_clear_open_context(filp);
return 0;
}
Patches currently in stable-queue which might be from olga.kornievskaia@xxxxxxxxx are
queue-4.9/nfsv4-fix-close-not-waiting-for-direct-io-compeletion.patch
queue-4.9/nfsv4.1-fix-rpc_call_done-assignment-for-bind_conn_t.patch
