On Sun, May 29, 2022 at 12:57:59PM +0000, Schroeder, Julian wrote:
> >> >> From: Julian Schroeder <jumaco@xxxxxxxxxx>
> >> >> Date: Fri, 20 May 2022 18:33:27 +0000
> >> >> Subject: [PATCH] nfsd: destroy percpu stats counters after reply cache
> >> >> shutdown
> >> >> MIME-Version: 1.0
> >> >> Content-Type: text/plain; charset=UTF-8
> >> >> Content-Transfer-Encoding: 8bit
> >> >> Upon nfsd shutdown any pending DRC cache is freed. DRC cache use is
> >> >> tracked via a percpu counter. In the current code the percpu counter
> >> >> is destroyed before. If any pending cache is still present,
> >> >> percpu_counter_add is called with a percpu counter==NULL. This causes
> >> >> a kernel crash.
> >> >> The solution is to destroy the percpu counter after the cache is freed.
> >> >> Fixes: e567b98ce9a4b (âEURoenfsd: protect concurrent access to nfsd stats countersâEUR)
> >> >> Signed-off-by: Julian Schroeder <jumaco@xxxxxxxxxx>
> >> >> ---
> >> >> fs/nfsd/nfscache.c | 2 +-
> >> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >> >> diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
> >> >> index 0b3f12aa37ff..7da88bdc0d6c 100644
> >> >> --- a/fs/nfsd/nfscache.c
> >> >> +++ b/fs/nfsd/nfscache.c
> >> >> @@ -206,7 +206,6 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
> >> >> struct svc_cacherep *rp;
> >> >> unsigned int i;
> >> >>
> >> >> - nfsd_reply_cache_stats_destroy(nn);
> >> >> unregister_shrinker(&nn->nfsd_reply_cache_shrinker);
> >> >>
> >> >> for (i = 0; i < nn->drc_hashsize; i++) {
> >> >> @@ -217,6 +216,7 @@ void nfsd_reply_cache_shutdown(struct nfsd_net *nn)
> >> >> rp, nn);
> >> >> }
> >> >> }
> >> >> + nfsd_reply_cache_stats_destroy(nn);
> >> >>
> >> >> kvfree(nn->drc_hashtbl);
> >> >> nn->drc_hashtbl = NULL;
> >> >> --
> >> >> 2.32.0
> >> >>
> >>
> >> >What is the git commit id of this in Linus's tree?
> >>
> >> >And this patch is totally damaged with whitespace and can not be applied
> >> >at all :(
> >>
> >> >Please fix it up and submit it again.
> >>
> >> >thanks,
> >>
> >> >greg k-h
> >>
> >> The patch made it into linux next. commit fd5e363eac77e.
> >> I sent the patch to stable again via git send-email (https://www.spinics.net/lists/stable/msg560818.html)
> >
> ><formletter>
> >
> >This is not the correct way to submit patches for inclusion in the
> >stable kernel tree. Please read:
> > https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> >for how to do this properly.
> >
> ></formletter>
> Upon nfsd shutdown any pending DRC cache is freed. DRC cache use is
> tracked via a percpu counter. In the current code the percpu counter
> is destroyed before. If any pending cache is still present,
> percpu_counter_add is called with a percpu counter==NULL. This causes
> a kernel crash.
> The solution is to destroy the percpu counter after the cache is freed.
>
> Fixes: e567b98ce9a4b (“nfsd: protect concurrent access to nfsd stats counters”)
> Signed-off-by: Julian Schroeder <jumaco@xxxxxxxxxx>
That is a very odd email address :(
Again, as the document says, just wait until a commit is in Linus's tree
and then send us the git commit id.
thanks,
greg k-h
