Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

sunrpc: svc_age_temp_xprts_now should not call setsockopt non-tcp transports

This fixes the following panic that can occur with NFSoRDMA.

general protection fault: 0000 [#1] SMP
Modules linked in: rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi
scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp
scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm
mlx5_ib ib_core intel_powerclamp coretemp kvm_intel kvm sg ioatdma
ipmi_devintf ipmi_ssif dcdbas iTCO_wdt iTCO_vendor_support pcspkr
irqbypass sb_edac shpchp dca crc32_pclmul ghash_clmulni_intel edac_core
lpc_ich aesni_intel lrw gf128mul glue_helper ablk_helper mei_me mei
ipmi_si cryptd wmi ipmi_msghandler acpi_pad acpi_power_meter nfsd
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod
crc_t10dif crct10dif_generic mgag200 i2c_algo_bit drm_kms_helper
syscopyarea sysfillrect sysimgblt ahci fb_sys_fops ttm libahci mlx5_core
tg3 crct10dif_pclmul drm crct10dif_common
ptp i2c_core libata crc32c_intel pps_core fjes dm_mirror dm_region_hash
dm_log dm_mod
CPU: 1 PID: 120 Comm: kworker/1:1 Not tainted 3.10.0-514.el7.x86_64 #1
Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.4.2 01/29/2015
Workqueue: events check_lifetime
task: ffff88031f506dd0 ti: ffff88031f584000 task.ti: ffff88031f584000
RIP: 0010:[<ffffffff8168d847>] [<ffffffff8168d847>]
_raw_spin_lock_bh+0x17/0x50
RSP: 0018:ffff88031f587ba8 EFLAGS: 00010206
RAX: 0000000000020000 RBX: 20041fac02080072 RCX: ffff88031f587fd8
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 20041fac02080072
RBP: ffff88031f587bb0 R08: 0000000000000008 R09: ffffffff8155be77
R10: ffff880322a59b00 R11: ffffea000bf39f00 R12: 20041fac02080072
R13: 000000000000000d R14: ffff8800c4fbd800 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff880322a40000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3c52d4547e CR3: 00000000019ba000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
20041fac02080002 ffff88031f587bd0 ffffffff81557830 20041fac02080002
ffff88031f587c78 ffff88031f587c40 ffffffff8155ae08 000000010157df32
0000000800000001 ffff88031f587c20 ffffffff81096acb ffffffff81aa37d0
Call Trace:
[<ffffffff81557830>] lock_sock_nested+0x20/0x50
[<ffffffff8155ae08>] sock_setsockopt+0x78/0x940
[<ffffffff81096acb>] ? lock_timer_base.isra.33+0x2b/0x50
[<ffffffff8155397d>] kernel_setsockopt+0x4d/0x50
[<ffffffffa0386284>] svc_age_temp_xprts_now+0x174/0x1e0 [sunrpc]
[<ffffffffa03b681d>] nfsd_inetaddr_event+0x9d/0xd0 [nfsd]
[<ffffffff81691ebc>] notifier_call_chain+0x4c/0x70
[<ffffffff810b687d>] __blocking_notifier_call_chain+0x4d/0x70
[<ffffffff810b68b6>] blocking_notifier_call_chain+0x16/0x20
[<ffffffff815e8538>] __inet_del_ifa+0x168/0x2d0
[<ffffffff815e8cef>] check_lifetime+0x25f/0x270
[<ffffffff810a7f3b>] process_one_work+0x17b/0x470
[<ffffffff810a8d76>] worker_thread+0x126/0x410
[<ffffffff810a8c50>] ? rescuer_thread+0x460/0x460
[<ffffffff810b052f>] kthread+0xcf/0xe0
[<ffffffff810b0460>] ? kthread_create_on_node+0x140/0x140
[<ffffffff81696418>] ret_from_fork+0x58/0x90
[<ffffffff810b0460>] ? kthread_create_on_node+0x140/0x140
Code: ca 75 f1 5d c3 0f 1f 80 00 00 00 00 eb d9 66 0f 1f 44 00 00 0f 1f
44 00 00 55 48 89 e5 53 48 89 fb e8 7e 04 a0 ff b8 00 00 02 00 <f0> 0f
c1 03 89 c2 c1 ea 10 66 39 c2 75 03 5b 5d c3 83 e2 fe 0f
RIP [<ffffffff8168d847>] _raw_spin_lock_bh+0x17/0x50
RSP <ffff88031f587ba8>

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Fixes: c3d4879e ("sunrpc: Add a function to close temporary transports immediately")
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

authored by

Scott Mayhew and committed by
J. Bruce Fields
ea08e392 f46c445b

+29 -10
+1
include/linux/sunrpc/svc_xprt.h
··· 25 25 void (*xpo_detach)(struct svc_xprt *); 26 26 void (*xpo_free)(struct svc_xprt *); 27 27 int (*xpo_secure_port)(struct svc_rqst *); 28 + void (*xpo_kill_temp_xprt)(struct svc_xprt *); 28 29 }; 29 30 30 31 struct svc_xprt_class {
+1 -10
net/sunrpc/svc_xprt.c
··· 1002 1002 void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr) 1003 1003 { 1004 1004 struct svc_xprt *xprt; 1005 - struct svc_sock *svsk; 1006 - struct socket *sock; 1007 1005 struct list_head *le, *next; 1008 1006 LIST_HEAD(to_be_closed); 1009 - struct linger no_linger = { 1010 - .l_onoff = 1, 1011 - .l_linger = 0, 1012 - }; 1013 1007 1014 1008 spin_lock_bh(&serv->sv_lock); 1015 1009 list_for_each_safe(le, next, &serv->sv_tempsocks) { ··· 1021 1027 list_del_init(le); 1022 1028 xprt = list_entry(le, struct svc_xprt, xpt_list); 1023 1029 dprintk("svc_age_temp_xprts_now: closing %p\n", xprt); 1024 - svsk = container_of(xprt, struct svc_sock, sk_xprt); 1025 - sock = svsk->sk_sock; 1026 - kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, 1027 - (char *)&no_linger, sizeof(no_linger)); 1030 + xprt->xpt_ops->xpo_kill_temp_xprt(xprt); 1028 1031 svc_close_xprt(xprt); 1029 1032 } 1030 1033 }
+21
net/sunrpc/svcsock.c
··· 438 438 return !test_bit(SOCK_NOSPACE, &svsk->sk_sock->flags); 439 439 } 440 440 441 + static void svc_tcp_kill_temp_xprt(struct svc_xprt *xprt) 442 + { 443 + struct svc_sock *svsk; 444 + struct socket *sock; 445 + struct linger no_linger = { 446 + .l_onoff = 1, 447 + .l_linger = 0, 448 + }; 449 + 450 + svsk = container_of(xprt, struct svc_sock, sk_xprt); 451 + sock = svsk->sk_sock; 452 + kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, 453 + (char *)&no_linger, sizeof(no_linger)); 454 + } 455 + 441 456 /* 442 457 * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo 443 458 */ ··· 663 648 return NULL; 664 649 } 665 650 651 + static void svc_udp_kill_temp_xprt(struct svc_xprt *xprt) 652 + { 653 + } 654 + 666 655 static struct svc_xprt *svc_udp_create(struct svc_serv *serv, 667 656 struct net *net, 668 657 struct sockaddr *sa, int salen, ··· 686 667 .xpo_has_wspace = svc_udp_has_wspace, 687 668 .xpo_accept = svc_udp_accept, 688 669 .xpo_secure_port = svc_sock_secure_port, 670 + .xpo_kill_temp_xprt = svc_udp_kill_temp_xprt, 689 671 }; 690 672 691 673 static struct svc_xprt_class svc_udp_class = { ··· 1262 1242 .xpo_has_wspace = svc_tcp_has_wspace, 1263 1243 .xpo_accept = svc_tcp_accept, 1264 1244 .xpo_secure_port = svc_sock_secure_port, 1245 + .xpo_kill_temp_xprt = svc_tcp_kill_temp_xprt, 1265 1246 }; 1266 1247 1267 1248 static struct svc_xprt_class svc_tcp_class = {
+6
net/sunrpc/xprtrdma/svc_rdma_transport.c
··· 67 67 static void svc_rdma_free(struct svc_xprt *xprt); 68 68 static int svc_rdma_has_wspace(struct svc_xprt *xprt); 69 69 static int svc_rdma_secure_port(struct svc_rqst *); 70 + static void svc_rdma_kill_temp_xprt(struct svc_xprt *); 70 71 71 72 static struct svc_xprt_ops svc_rdma_ops = { 72 73 .xpo_create = svc_rdma_create, ··· 80 79 .xpo_has_wspace = svc_rdma_has_wspace, 81 80 .xpo_accept = svc_rdma_accept, 82 81 .xpo_secure_port = svc_rdma_secure_port, 82 + .xpo_kill_temp_xprt = svc_rdma_kill_temp_xprt, 83 83 }; 84 84 85 85 struct svc_xprt_class svc_rdma_class = { ··· 1317 1315 static int svc_rdma_secure_port(struct svc_rqst *rqstp) 1318 1316 { 1319 1317 return 1; 1318 + } 1319 + 1320 + static void svc_rdma_kill_temp_xprt(struct svc_xprt *xprt) 1321 + { 1320 1322 } 1321 1323 1322 1324 int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)