nfs: don't share pNFS DS connections between net namespaces

Currently, different NFS clients can share the same DS connections, even
when they are in different net namespaces. If a containerized client
creates a DS connection, another container can find and use it. When the
first client exits, the connection will close which can lead to stalls
in other clients.

Add a net namespace pointer to struct nfs4_pnfs_ds, and compare those
value to the caller's netns in _data_server_lookup_locked() when
searching for a nfs4_pnfs_ds to match.

Reported-by: Omar Sandoval <osandov@osandov.com>
Reported-by: Sargun Dillon <sargun@sargun.me>
Closes: https://lore.kernel.org/linux-nfs/Z_ArpQC_vREh_hEA@telecaster/
Tested-by: Sargun Dillon <sargun@sargun.me>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Link: https://lore.kernel.org/r/20250410-nfs-ds-netns-v2-1-f80b7979ba80@kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

diff --git a/fs/nfs/filelayout/filelayoutdev.c b/fs/nfs/filelayout/filelayoutdev.c
index 4fa304fa5bc4b2346458877c39a558936a49317a..29d9234d5c085f3feda9abf6a98cd5e272f22613 100644 (file)
--- a/fs/nfs/filelayout/filelayoutdev.c
+++ b/fs/nfs/filelayout/filelayoutdev.c
@@ -76,6 +76,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
        struct page *scratch;
        struct list_head dsaddrs;
        struct nfs4_pnfs_ds_addr *da;
+       struct net *net = server->nfs_client->cl_net;
 
        /* set up xdr stream */
        scratch = alloc_page(gfp_flags);
@@ -159,8 +160,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 
                mp_count = be32_to_cpup(p); /* multipath count */
                for (j = 0; j < mp_count; j++) {
-                       da = nfs4_decode_mp_ds_addr(server->nfs_client->cl_net,
-                                                   &stream, gfp_flags);
+                       da = nfs4_decode_mp_ds_addr(net, &stream, gfp_flags);
                        if (da)
                                list_add_tail(&da->da_node, &dsaddrs);
                }
@@ -170,7 +170,7 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
                        goto out_err_free_deviceid;
                }
 
-               dsaddr->ds_list[i] = nfs4_pnfs_ds_add(&dsaddrs, gfp_flags);
+               dsaddr->ds_list[i] = nfs4_pnfs_ds_add(net, &dsaddrs, gfp_flags);
                if (!dsaddr->ds_list[i])
                        goto out_err_drain_dsaddrs;
                trace_fl_getdevinfo(server, &pdev->dev_id, dsaddr->ds_list[i]->ds_remotestr);

diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index e58bedfb1dcc14307e0cb3bc7011ed3f199eecc6..4a304cf17c4b07a07b9e25e48af9d83c345d2ac1 100644 (file)
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -49,6 +49,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
        struct nfs4_pnfs_ds_addr *da;
        struct nfs4_ff_layout_ds *new_ds = NULL;
        struct nfs4_ff_ds_version *ds_versions = NULL;
+       struct net *net = server->nfs_client->cl_net;
        u32 mp_count;
        u32 version_count;
        __be32 *p;
@@ -80,8 +81,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 
        for (i = 0; i < mp_count; i++) {
                /* multipath ds */
-               da = nfs4_decode_mp_ds_addr(server->nfs_client->cl_net,
-                                           &stream, gfp_flags);
+               da = nfs4_decode_mp_ds_addr(net, &stream, gfp_flags);
                if (da)
                        list_add_tail(&da->da_node, &dsaddrs);
        }
@@ -149,7 +149,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
        new_ds->ds_versions = ds_versions;
        new_ds->ds_versions_cnt = version_count;
 
-       new_ds->ds = nfs4_pnfs_ds_add(&dsaddrs, gfp_flags);
+       new_ds->ds = nfs4_pnfs_ds_add(net, &dsaddrs, gfp_flags);
        if (!new_ds->ds)
                goto out_err_drain_dsaddrs;
 

diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 30d2613e912b8804c994fc19e25b767f360ce51a..91ff877185c8afe462eb81f6571afd3ade14ffb4 100644 (file)
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -60,6 +60,7 @@ struct nfs4_pnfs_ds {
        struct list_head        ds_node;  /* nfs4_pnfs_dev_hlist dev_dslist */
        char                    *ds_remotestr;  /* comma sep list of addrs */
        struct list_head        ds_addrs;
+       const struct net        *ds_net;
        struct nfs_client       *ds_clp;
        refcount_t              ds_count;
        unsigned long           ds_state;
@@ -415,7 +416,8 @@ int pnfs_generic_commit_pagelist(struct inode *inode,
 int pnfs_generic_scan_commit_lists(struct nfs_commit_info *cinfo, int max);
 void pnfs_generic_write_commit_done(struct rpc_task *task, void *data);
 void nfs4_pnfs_ds_put(struct nfs4_pnfs_ds *ds);
-struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(struct list_head *dsaddrs,
+struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(const struct net *net,
+                                     struct list_head *dsaddrs,
                                      gfp_t gfp_flags);
 void nfs4_pnfs_v3_ds_connect_unload(void);
 int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,

diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index dbef837e871ad44e401461c39f04b159ec43f2f6..2ee20a0f0b36d3b38e35c4cad966b9d58fa822f4 100644 (file)
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -604,12 +604,12 @@ _same_data_server_addrs_locked(const struct list_head *dsaddrs1,
  * Lookup DS by addresses.  nfs4_ds_cache_lock is held
  */
 static struct nfs4_pnfs_ds *
-_data_server_lookup_locked(const struct list_head *dsaddrs)
+_data_server_lookup_locked(const struct net *net, const struct list_head *dsaddrs)
 {
        struct nfs4_pnfs_ds *ds;
 
        list_for_each_entry(ds, &nfs4_data_server_cache, ds_node)
-               if (_same_data_server_addrs_locked(&ds->ds_addrs, dsaddrs))
+               if (ds->ds_net == net && _same_data_server_addrs_locked(&ds->ds_addrs, dsaddrs))
                        return ds;
        return NULL;
 }
@@ -716,7 +716,7 @@ out_err:
  * uncached and return cached struct nfs4_pnfs_ds.
  */
 struct nfs4_pnfs_ds *
-nfs4_pnfs_ds_add(struct list_head *dsaddrs, gfp_t gfp_flags)
+nfs4_pnfs_ds_add(const struct net *net, struct list_head *dsaddrs, gfp_t gfp_flags)
 {
        struct nfs4_pnfs_ds *tmp_ds, *ds = NULL;
        char *remotestr;
@@ -734,13 +734,14 @@ nfs4_pnfs_ds_add(struct list_head *dsaddrs, gfp_t gfp_flags)
        remotestr = nfs4_pnfs_remotestr(dsaddrs, gfp_flags);
 
        spin_lock(&nfs4_ds_cache_lock);
-       tmp_ds = _data_server_lookup_locked(dsaddrs);
+       tmp_ds = _data_server_lookup_locked(net, dsaddrs);
        if (tmp_ds == NULL) {
                INIT_LIST_HEAD(&ds->ds_addrs);
                list_splice_init(dsaddrs, &ds->ds_addrs);
                ds->ds_remotestr = remotestr;
                refcount_set(&ds->ds_count, 1);
                INIT_LIST_HEAD(&ds->ds_node);
+               ds->ds_net = net;
                ds->ds_clp = NULL;
                list_add(&ds->ds_node, &nfs4_data_server_cache);
                dprintk("%s add new data server %s\n", __func__,