Patch "NFSD: Fix nfsd4_shutdown_copy()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    NFSD: Fix nfsd4_shutdown_copy()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nfsd-fix-nfsd4_shutdown_copy.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 87111e09628d4eb85eacf3b139966af409f3965b
Author: Chuck Lever <chuck.lever@xxxxxxxxxx>
Date:   Thu Oct 31 09:40:03 2024 -0400

    NFSD: Fix nfsd4_shutdown_copy()
    
    [ Upstream commit 62a8642ba00aa8ceb0a02ade942f5ec52e877c95 ]
    
    nfsd4_shutdown_copy() is just this:
    
            while ((copy = nfsd4_get_copy(clp)) != NULL)
                    nfsd4_stop_copy(copy);
    
    nfsd4_get_copy() bumps @copy's reference count, preventing
    nfsd4_stop_copy() from releasing @copy.
    
    A while loop like this usually works by removing the first element
    of the list, but neither nfsd4_get_copy() nor nfsd4_stop_copy()
    alters the async_copies list.
    
    Best I can tell, then, is that nfsd4_shutdown_copy() continues to
    loop until other threads manage to remove all the items from this
    list. The spinning loop blocks shutdown until these items are gone.
    
    Possibly the reason we haven't seen this issue in the field is
    because client_has_state() prevents __destroy_client() from calling
    nfsd4_shutdown_copy() if there are any items on this list. In a
    subsequent patch I plan to remove that restriction.
    
    Fixes: e0639dc5805a ("NFSD introduce async copy feature")
    Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 0b698e25826fa..c48c1a3be5d2f 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1256,7 +1256,7 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy)
 	nfs4_put_copy(copy);
 }
 
-static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
+static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp)
 {
 	struct nfsd4_copy *copy = NULL;
 
@@ -1265,6 +1265,9 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
 		copy = list_first_entry(&clp->async_copies, struct nfsd4_copy,
 					copies);
 		refcount_inc(&copy->refcount);
+		copy->cp_clp = NULL;
+		if (!list_empty(&copy->copies))
+			list_del_init(&copy->copies);
 	}
 	spin_unlock(&clp->async_lock);
 	return copy;
@@ -1274,7 +1277,7 @@ void nfsd4_shutdown_copy(struct nfs4_client *clp)
 {
 	struct nfsd4_copy *copy;
 
-	while ((copy = nfsd4_get_copy(clp)) != NULL)
+	while ((copy = nfsd4_unhash_copy(clp)) != NULL)
 		nfsd4_stop_copy(copy);
 }
 #ifdef CONFIG_NFSD_V4_2_INTER_SSC