]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
NFSD: Close cached file handles when revoking export state
authorChuck Lever <chuck.lever@oracle.com>
Sun, 19 Apr 2026 18:53:07 +0000 (14:53 -0400)
committerChuck Lever <cel@kernel.org>
Tue, 9 Jun 2026 20:32:59 +0000 (16:32 -0400)
When NFSD_CMD_UNLOCK_EXPORT revokes NFSv4 state for an export path,
GC-managed nfsd_file entries for files under that path may remain
in the file cache.  These cached handles hold the underlying
filesystem busy, preventing a subsequent unmount.

Add nfsd_file_close_export(), which walks the nfsd_file hash table
and closes GC-eligible entries whose underlying file resides on the
same filesystem and is a descendant of the export path.  Because
nfsd_file entries do not carry an export reference, the ancestry
check uses is_subdir() on the file's dentry.  False positives --
closing a cached handle that did not originate from the target
export -- are harmless; the handle is simply reopened on the next
access.

The handler calls nfsd_file_close_export() before revoking NFSv4
state, mirroring the order used by NFSD_CMD_UNLOCK_FILESYSTEM
(which cancels copies and releases NLM locks before revoking
state).  Both calls run under nfsd_mutex.

Reviewed-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
fs/nfsd/filecache.c
fs/nfsd/filecache.h
fs/nfsd/nfsctl.c

index 1e2b38ed1d35d639f837d95a1232641341920256..24511c3208db9e0809ddba7d0e34dcf468f2058b 100644 (file)
@@ -724,6 +724,52 @@ nfsd_file_close_inode_sync(struct inode *inode)
        nfsd_file_dispose_list(&dispose);
 }
 
+/**
+ * nfsd_file_close_export - close cached file handles for an export
+ * @net: net namespace in which to operate
+ * @path: export path whose cached files should be closed
+ *
+ * Close out GC-managed nfsd_file entries whose underlying file is on
+ * the same filesystem as, and a descendant of, @path.  nfsd_file
+ * entries do not carry an export reference, so the check uses the
+ * file's dentry ancestry.  False positives (closing a cached handle
+ * that did not originate from the target export) are harmless -- the
+ * handle is simply reopened on the next access.
+ *
+ * Called from the NFSD_CMD_UNLOCK_EXPORT handler before revoking
+ * NFSv4 state, to ensure that cached file handles do not hold the
+ * filesystem busy.
+ */
+void nfsd_file_close_export(struct net *net, const struct path *path)
+{
+       struct rhashtable_iter iter;
+       struct nfsd_file *nf;
+       LIST_HEAD(dispose);
+
+       rhltable_walk_enter(&nfsd_file_rhltable, &iter);
+       do {
+               rhashtable_walk_start(&iter);
+
+               nf = rhashtable_walk_next(&iter);
+               while (!IS_ERR_OR_NULL(nf)) {
+                       if (nf->nf_net == net &&
+                           test_bit(NFSD_FILE_GC, &nf->nf_flags) &&
+                           nf->nf_file &&
+                           file_inode(nf->nf_file)->i_sb ==
+                                       path->dentry->d_sb &&
+                           is_subdir(nf->nf_file->f_path.dentry,
+                                     path->dentry))
+                               nfsd_file_cond_queue(nf, &dispose);
+                       nf = rhashtable_walk_next(&iter);
+               }
+
+               rhashtable_walk_stop(&iter);
+       } while (nf == ERR_PTR(-EAGAIN));
+       rhashtable_walk_exit(&iter);
+
+       nfsd_file_dispose_list(&dispose);
+}
+
 static int
 nfsd_file_lease_notifier_call(struct notifier_block *nb, unsigned long arg,
                            void *data)
index b383dbc5b9218d21a29b852572f80fab08de9fa9..683b6437cacc244415fa89fdc7c59a79fc579f53 100644 (file)
@@ -70,6 +70,7 @@ struct net *nfsd_file_put_local(struct nfsd_file __rcu **nf);
 struct nfsd_file *nfsd_file_get(struct nfsd_file *nf);
 struct file *nfsd_file_file(struct nfsd_file *nf);
 void nfsd_file_close_inode_sync(struct inode *inode);
+void nfsd_file_close_export(struct net *net, const struct path *path);
 void nfsd_file_net_dispose(struct nfsd_net *nn);
 bool nfsd_file_is_cached(struct inode *inode);
 __be32 nfsd_file_acquire_gc(struct svc_rqst *rqstp, struct svc_fh *fhp,
index dd4fb9249213c52ec5c6abb868dc2c9ebaca994c..92f4c333f0ff5aa2873f618ebdcc50c411778e25 100644 (file)
@@ -2389,9 +2389,10 @@ int nfsd_nl_unlock_export_doit(struct sk_buff *skb, struct genl_info *info)
                return error;
 
        mutex_lock(&nfsd_mutex);
-       if (nn->nfsd_serv)
+       if (nn->nfsd_serv) {
+               nfsd_file_close_export(net, &path);
                nfsd4_revoke_export_states(nn, &path);
-       else
+       else
                error = -EINVAL;
        mutex_unlock(&nfsd_mutex);