>> >> From: Julian Schroeder <jumaco@xxxxxxxxxx>
>> >> Date: Fri, 20 May 2022 18:33:27 +0000
>> >> Subject: [PATCH] nfsd: destroy percpu stats counters after reply cache
>> >> shutdown
>> >> MIME-Version: 1.0
>> >> Content-Type: text/plain; charset=UTF-8
>> >> Content-Transfer-Encoding: 8bit
>> >> Upon nfsd shutdown any pending DRC cache is freed. DRC cache use is
>> >> tracked via a percpu counter. In the current code the percpu counter
>> >> is destroyed before. If any pending cache is still present,
>> >> percpu_counter_add is called with a percpu counter==NULL. This causes
>> >> a kernel crash.
>> >> The solution is to destroy the percpu counter after the cache is freed.
>> >> Fixes: e567b98ce9a4b (âEURoenfsd: protect concurrent access to nfsd stats countersâEUR)
>> >> Signed-off-by: Julian Schroeder <jumaco@xxxxxxxxxx>
>> >> ---
>> >> fs/nfsd/nfscache.c | 2 +-
>> >> 1 file changed, 1 insertion(+), 1 deletion(-)
>> >> diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
>> >> index 0b3f12aa37ff..7da88bdc0d6c 100644
>> >> --- a/fs/nfsd/nfscache.c
>> >> +++ b/fs/nfsd/nfscache.c
>> >> @@ -206,7 +206,6 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
>> >> struct svc_cacherep *rp;
>> >> unsigned int i;
>> >>
>> >> - nfsd_reply_cache_stats_destroy(nn);
>> >> unregister_shrinker(&nn->nfsd_reply_cache_shrinker);
>> >>
>> >> for (i = 0; i < nn->drc_hashsize; i++) {
>> >> @@ -217,6 +216,7 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
>> >> rp, nn);
>> >> }
>> >> }
>> >> + nfsd_reply_cache_stats_destroy(nn);
>> >>
>> >> kvfree(nn->drc_hashtbl);
>> >> nn->drc_hashtbl = NULL;
>> >> --
>> >> 2.32.0
>> >>
>>
>> >What is the git commit id of this in Linus's tree?
>>
>> >And this patch is totally damaged with whitespace and can not be applied
>> >at all :(
>>
>> >Please fix it up and submit it again.
>>
>> >thanks,
>>
>> >greg k-h
>>
>> The patch made it into linux next. commit fd5e363eac77e.
>> I sent the patch to stable again via git send-email (https://www.spinics.net/lists/stable/msg560818.html)
>
><formletter>
>
>This is not the correct way to submit patches for inclusion in the
>stable kernel tree. Please read:
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>for how to do this properly.
>
></formletter>
Upon nfsd shutdown any pending DRC cache is freed. DRC cache use is
tracked via a percpu counter. In the current code the percpu counter
is destroyed before. If any pending cache is still present,
percpu_counter_add is called with a percpu counter==NULL. This causes
a kernel crash.
The solution is to destroy the percpu counter after the cache is freed.
Fixes: e567b98ce9a4b (“nfsd: protect concurrent access to nfsd stats counters”)
Signed-off-by: Julian Schroeder <jumaco@xxxxxxxxxx>
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 0b3f12aa37ff..7da88bdc0d6c 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -206,7 +206,6 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
struct svc_cacherep *rp;
unsigned int i;
- nfsd_reply_cache_stats_destroy(nn);
unregister_shrinker(&nn->nfsd_reply_cache_shrinker);
for (i = 0; i < nn->drc_hashsize; i++) {
@@ -217,6 +216,7 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
rp, nn);
}
}
+ nfsd_reply_cache_stats_destroy(nn);
kvfree(nn->drc_hashtbl);
nn->drc_hashtbl = NULL;
--
2.32.0
