4.4-stable patches

added patches:
	nfsd-fix-general-protection-fault-in-release_lock_stateid.patch

diff --git a/queue-4.4/nfsd-fix-general-protection-fault-in-release_lock_stateid.patch b/queue-4.4/nfsd-fix-general-protection-fault-in-release_lock_stateid.patch
new file mode 100644 (file)
index 0000000..c9acf49
--- /dev/null
+++ b/queue-4.4/nfsd-fix-general-protection-fault-in-release_lock_stateid.patch
@@ -0,0 +1,107 @@
+From f46c445b79906a9da55c13e0a6f6b6a006b892fe Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Sat, 29 Oct 2016 18:19:03 -0400
+Subject: nfsd: Fix general protection fault in release_lock_stateid()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit f46c445b79906a9da55c13e0a6f6b6a006b892fe upstream.
+
+When I push NFSv4.1 / RDMA hard, (xfstests generic/089, for example),
+I get this crash on the server:
+
+Oct 28 22:04:30 klimt kernel: general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
+Oct 28 22:04:30 klimt kernel: Modules linked in: cts rpcsec_gss_krb5 iTCO_wdt iTCO_vendor_support sb_edac edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm btrfs irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd xor pcspkr raid6_pq i2c_i801 i2c_smbus lpc_ich mfd_core sg mei_me mei ioatdma shpchp wmi ipmi_si ipmi_msghandler rpcrdma ib_ipoib rdma_ucm acpi_power_meter acpi_pad ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c mlx4_ib mlx4_en ib_core sr_mod cdrom sd_mod ast drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm crc32c_intel igb ahci libahci ptp mlx4_core pps_core dca libata i2c_algo_bit i2c_core dm_mirror dm_region_hash dm_log dm_mod
+Oct 28 22:04:30 klimt kernel: CPU: 7 PID: 1558 Comm: nfsd Not tainted 4.9.0-rc2-00005-g82cd754 #8
+Oct 28 22:04:30 klimt kernel: Hardware name: Supermicro Super Server/X10SRL-F, BIOS 1.0c 09/09/2015
+Oct 28 22:04:30 klimt kernel: task: ffff880835c3a100 task.stack: ffff8808420d8000
+Oct 28 22:04:30 klimt kernel: RIP: 0010:[<ffffffffa05a759f>]  [<ffffffffa05a759f>] release_lock_stateid+0x1f/0x60 [nfsd]
+Oct 28 22:04:30 klimt kernel: RSP: 0018:ffff8808420dbce0  EFLAGS: 00010246
+Oct 28 22:04:30 klimt kernel: RAX: ffff88084e6660f0 RBX: ffff88084e667020 RCX: 0000000000000000
+Oct 28 22:04:30 klimt kernel: RDX: 0000000000000007 RSI: 0000000000000000 RDI: ffff88084e667020
+Oct 28 22:04:30 klimt kernel: RBP: ffff8808420dbcf8 R08: 0000000000000001 R09: 0000000000000000
+Oct 28 22:04:30 klimt kernel: R10: ffff880835c3a100 R11: ffff880835c3aca8 R12: 6b6b6b6b6b6b6b6b
+Oct 28 22:04:30 klimt kernel: R13: ffff88084e6670d8 R14: ffff880835f546f0 R15: ffff880835f1c548
+Oct 28 22:04:30 klimt kernel: FS:  0000000000000000(0000) GS:ffff88087bdc0000(0000) knlGS:0000000000000000
+Oct 28 22:04:30 klimt kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Oct 28 22:04:30 klimt kernel: CR2: 00007ff020389000 CR3: 0000000001c06000 CR4: 00000000001406e0
+Oct 28 22:04:30 klimt kernel: Stack:
+Oct 28 22:04:30 klimt kernel: ffff88084e667020 0000000000000000 ffff88084e6670d8 ffff8808420dbd20
+Oct 28 22:04:30 klimt kernel: ffffffffa05ac80d ffff880835f54548 ffff88084e640008 ffff880835f545b0
+Oct 28 22:04:30 klimt kernel: ffff8808420dbd70 ffffffffa059803d ffff880835f1c768 0000000000000870
+Oct 28 22:04:30 klimt kernel: Call Trace:
+Oct 28 22:04:30 klimt kernel: [<ffffffffa05ac80d>] nfsd4_free_stateid+0xfd/0x1b0 [nfsd]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa059803d>] nfsd4_proc_compound+0x40d/0x690 [nfsd]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa0583114>] nfsd_dispatch+0xd4/0x1d0 [nfsd]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa047bbf9>] svc_process_common+0x3d9/0x700 [sunrpc]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa047ca64>] svc_process+0xf4/0x330 [sunrpc]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa05827ca>] nfsd+0xfa/0x160 [nfsd]
+Oct 28 22:04:30 klimt kernel: [<ffffffffa05826d0>] ? nfsd_destroy+0x170/0x170 [nfsd]
+Oct 28 22:04:30 klimt kernel: [<ffffffff810b367b>] kthread+0x10b/0x120
+Oct 28 22:04:30 klimt kernel: [<ffffffff810b3570>] ? kthread_stop+0x280/0x280
+Oct 28 22:04:30 klimt kernel: [<ffffffff8174e8ba>] ret_from_fork+0x2a/0x40
+Oct 28 22:04:30 klimt kernel: Code: c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 48 8b 87 b0 00 00 00 48 89 fb 4c 8b a0 98 00 00 00 <49> 8b 44 24 20 48 8d b8 80 03 00 00 e8 10 66 1a e1 48 89 df e8
+Oct 28 22:04:30 klimt kernel: RIP  [<ffffffffa05a759f>] release_lock_stateid+0x1f/0x60 [nfsd]
+Oct 28 22:04:30 klimt kernel: RSP <ffff8808420dbce0>
+Oct 28 22:04:30 klimt kernel: ---[ end trace cf5d0b371973e167 ]---
+
+Jeff Layton says:
+> Hm...now that I look though, this is a little suspicious:
+>
+>    struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
+>
+> I wonder if it's possible for the openstateid to have already been
+> destroyed at this point.
+>
+> We might be better off doing something like this to get the client pointer:
+>
+>    stp->st_stid.sc_client;
+>
+> ...which should be more direct and less dependent on other stateids
+> staying valid.
+
+With the suggested change, I am no longer able to reproduce the above oops.
+
+v2: Fix unhash_lock_stateid() as well
+
+Fix-suggested-by: Jeff Layton <jlayton@redhat.com>
+Fixes: 42691398be08 ('nfsd: Fix race between FREE_STATEID and LOCK')
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Cc: Christian Theune <ct@flyingcircus.io>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4state.c |   10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1145,9 +1145,7 @@ static void put_ol_stateid_locked(struct
+ 
+ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+-      struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
+-
+-      lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
++      lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
+ 
+       list_del_init(&stp->st_locks);
+       nfs4_unhash_stid(&stp->st_stid);
+@@ -1156,12 +1154,12 @@ static bool unhash_lock_stateid(struct n
+ 
+ static void release_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+-      struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
++      struct nfs4_client *clp = stp->st_stid.sc_client;
+       bool unhashed;
+ 
+-      spin_lock(&oo->oo_owner.so_client->cl_lock);
++      spin_lock(&clp->cl_lock);
+       unhashed = unhash_lock_stateid(stp);
+-      spin_unlock(&oo->oo_owner.so_client->cl_lock);
++      spin_unlock(&clp->cl_lock);
+       if (unhashed)
+               nfs4_put_stid(&stp->st_stid);
+ }

diff --git a/queue-4.4/series b/queue-4.4/series
index e48cf96bea2c844f639d984bd742ac91630a5691..e65061fec9d831ceb0f06549ddff8e29563426d5 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -12,3 +12,4 @@ ipv6-fix-typo-in-fib6_net_exit.patch
 f2fs-check-hot_data-for-roll-forward-recovery.patch
 x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch
 md-raid5-release-flush-io-in-raid5_do_work.patch
+nfsd-fix-general-protection-fault-in-release_lock_stateid.patch