This is a note to let you know that I've just added the patch titled pNFS: Ensure LAYOUTGET and LAYOUTRETURN are properly serialised to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: pnfs-ensure-layoutget-and-layoutreturn-are-properly-serialised.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From bf0291dd2267a2b9a4cd74d65249553d11bb45d6 Mon Sep 17 00:00:00 2001 From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> Date: Sat, 3 Sep 2016 10:39:51 -0400 Subject: pNFS: Ensure LAYOUTGET and LAYOUTRETURN are properly serialised From: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> commit bf0291dd2267a2b9a4cd74d65249553d11bb45d6 upstream. According to RFC5661, the client is responsible for serialising LAYOUTGET and LAYOUTRETURN to avoid ambiguity. Consider the case where we send both in parallel. Client Server ====== ====== LAYOUTGET(seqid=X) LAYOUTRETURN(seqid=X) LAYOUTGET return seqid=X+1 LAYOUTRETURN return seqid=X+2 Process LAYOUTRETURN Forget layout stateid Process LAYOUTGET Set seqid=X+1 The client processes the layoutget/layoutreturn in the wrong order, and since the result of the layoutreturn was to clear the only existing layout segment, the client forgets the layout stateid. When the LAYOUTGET comes in, it is treated as having a completely new stateid, and so the client sets the wrong sequence id... Fix is to check if there are outstanding LAYOUTGET requests before we send the LAYOUTRETURN (note that LAYOUGET will already wait if it sees an outstanding LAYOUTRETURN). Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> Signed-off-by: Trond Myklebust <trond.myklebust@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/nfs/pnfs.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -876,6 +876,9 @@ void pnfs_clear_layoutreturn_waitbit(str static bool pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo) { + /* Serialise LAYOUTGET/LAYOUTRETURN */ + if (atomic_read(&lo->plh_outstanding) != 0) + return false; if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) return false; lo->plh_return_iomode = 0; Patches currently in stable-queue which might be from trond.myklebust@xxxxxxxxxxxxxxx are queue-4.7/nfsv4.1-fix-oopsable-condition-in-server-callback-races.patch queue-4.7/pnfs-ensure-layoutget-and-layoutreturn-are-properly-serialised.patch queue-4.7/nfsv4.x-fix-a-refcount-leak-in-nfs_callback_up_net.patch queue-4.7/pnfs-flexfiles-fix-an-oopsable-condition-when-connection-to-the-ds-fails.patch queue-4.7/nfsv4.1-fix-the-create_session-slot-number-accounting.patch queue-4.7/pnfs-the-client-must-not-do-i-o-to-the-ds-if-it-s-lease-has-expired.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html