FAILED: patch "[PATCH] nfsd: unregister with rpcbind when deleting a transport" failed to apply to 6.12-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 898374fdd7f06fa4c4a66e8be3135efeae6128d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025101547-demeanor-rectify-27be@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 898374fdd7f06fa4c4a66e8be3135efeae6128d5 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <[email protected]>
Date: Tue, 19 Aug 2025 14:04:02 -0400
Subject: [PATCH] nfsd: unregister with rpcbind when deleting a transport
When a listener is added, a part of creation of transport also registers program/port with rpcbind. However, when the listener is removed, while transport goes away, rpcbind still has the entry for that port/type.
When deleting the transport, unregister with rpcbind when appropriate.
---v2 created a new xpt_flag XPT_RPCB_UNREG to mark TCP and UDP transport and at xprt destroy send rpcbind unregister if flag set.
include/linux/sunrpc/svc_xprt.h +3 -0
@@ -104,6 +104,9 @@ enum {* it has access to. It is NOT counted * in ->sv_tmpcnt. */ + XPT_RPCB_UNREG, /* transport that needs unregistering +* with rpcbind (TCP, UDP) on destroy +*/ };/*
net/sunrpc/svc_xprt.c +13 -0
@@ -1014,6 +1014,19 @@ static void svc_delete_xprt(struct svc_xprt *xprt)struct svc_serv *serv = xprt->xpt_server;struct svc_deferred_req *dr; +/* unregister with rpcbind for when transport type is TCP or UDP. +*/ +if (test_bit (XPT_RPCB_UNREG , &xprt->xpt_flags)) { + struct svc_sock *svsk = container_of(xprt, struct svc_sock, + sk_xprt); +struct socket *sock = svsk->sk_sock; + +if (svc_register (serv, xprt->xpt_net, sock->sk->sk_family, + sock->sk->sk_protocol,0 ) <0 ) +pr_warn ("failed to unregister %s with rpcbind\n" , + xprt->xpt_class->xcl_name); + } +if (test_and_set_bit (XPT_DEAD , &xprt->xpt_flags))return ;
net/sunrpc/svcsock.c +2 -0
@@ -836,6 +836,7 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)/* data might have come in before data_ready set up */ set_bit (XPT_DATA , &svsk->sk_xprt.xpt_flags);set_bit (XPT_CHNGBUF , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags);/* make sure we get destination address info */ switch (svsk->sk_sk->sk_family) {
@@ -1350,6 +1351,7 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)if (sk->sk_state ==TCP_LISTEN ) {strcpy (svsk->sk_xprt.xpt_remotebuf,"listener" );set_bit (XPT_LISTENER , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags); sk->sk_data_ready = svc_tcp_listen_data_ready;set_bit (XPT_CONN , &svsk->sk_xprt.xpt_flags); }else {
Sasha Levin
maintainerPATCH 1/5 nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
From: Pali Rohár <[email protected]>
[ Upstream commit bb4f07f2409c26c01e97e6f9b432545f353e3b66 ]
Currently NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT do not bypass only GSS, but bypass any method. This is a problem specially for NFS3 AUTH_NULL-only exports.
The purpose of NFSD_MAY_BYPASS_GSS_ON_ROOT is described in RFC 2623, section 2.3.2, to allow mounting NFS2/3 GSS-only export without authentication. So few procedures which do not expose security risk used during mount time can be called also with AUTH_NONE or AUTH_SYS, to allow client mount operation to finish successfully.
The problem with current implementation is that for AUTH_NULL-only exports, the NFSD_MAY_BYPASS_GSS_ON_ROOT is active also for NFS3 AUTH_UNIX mount attempts which confuse NFS3 clients, and make them think that AUTH_UNIX is enabled and is working. Linux NFS3 client never switches from AUTH_UNIX to AUTH_NONE on active mount, which makes the mount inaccessible.
Fix the NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT implementation and really allow to bypass only exports which have enabled some real authentication (GSS, TLS, or any other).
The result would be: For AUTH_NULL-only export if client attempts to do mount with AUTH_UNIX flavor then it will receive access errors, which instruct client that AUTH_UNIX flavor is not usable and will either try other auth flavor (AUTH_NULL if enabled) or fails mount procedure. Similarly if client attempt to do mount with AUTH_NULL flavor and only AUTH_UNIX flavor is enabled then the client will receive access error.
This should fix problems with AUTH_NULL-only or AUTH_UNIX-only exports if client attempts to mount it with other auth flavor (e.g. with AUTH_NULL for AUTH_UNIX-only export, or with AUTH_UNIX for AUTH_NULL-only export).
Stable-dep-of: 898374fdd7f0 ("nfsd: unregister with rpcbind when deleting a transport")
--- fs/nfsd/export.c | 21 ++++++++++++++++++++- fs/nfsd/export.h | 3 ++- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfsfh.c | 9 ++++++--- fs/nfsd/vfs.c | 2 +- 6 files changed, 31 insertions(+), 8 deletions(-)
fs/nfsd/export.c +20 -1
@@ -1078,12 +1078,14 @@ static struct svc_export *exp_find(struct cache_detail *cd,* check_nfsd_access - check if access to export is allowed. * @exp: svc_export that is being accessed. * @rqstp: svc_rqst attempting to access @exp (will be NULL for LOCALIO). +* @may_bypass_gss: reduce strictness of authorization check * * Return values: * %nfs_ok if access is granted, or * %nfserr_wrongsec if access is denied */ -__be32 check_nfsd_access (struct svc_export *exp,struct svc_rqst *rqstp) +__be32 check_nfsd_access (struct svc_export *exp,struct svc_rqst *rqstp, +bool may_bypass_gss) {struct exp_flavor_info *f, *end = exp->ex_flavors + exp->ex_nflavors;struct svc_xprt *xprt;
@@ -1140,6 +1142,23 @@ __be32 check_nfsd_access(struct svc_export *exp, struct svc_rqst *rqstp)if (nfsd4_spo_must_allow (rqstp))return nfs_ok; +/* Some calls may be processed without authentication +* on GSS exports. For example NFS2/3 calls on root +* directory, see section 2.3.2 of rfc 2623. +* For "may_bypass_gss" check that export has really +* enabled some flavor with authentication (GSS or any +* other) and also check that the used auth flavor is +* without authentication (none or sys). +*/ +if (may_bypass_gss && ( + rqstp->rq_cred.cr_flavor ==RPC_AUTH_NULL || + rqstp->rq_cred.cr_flavor ==RPC_AUTH_UNIX )) { +for (f = exp->ex_flavors; f < end; f++) { +if (f->pseudoflavor >=RPC_AUTH_DES ) +return 0 ; + } + } + denied:return nfserr_wrongsec; }
fs/nfsd/export.h +2 -1
@@ -101,7 +101,8 @@ struct svc_expkey {struct svc_cred ;int nfsexp_flags (struct svc_cred *cred,struct svc_export *exp); -__be32 check_nfsd_access (struct svc_export *exp,struct svc_rqst *rqstp); +__be32 check_nfsd_access (struct svc_export *exp,struct svc_rqst *rqstp, +bool may_bypass_gss);/* * Function declarations
fs/nfsd/nfs4proc.c +1 -1
@@ -2799,7 +2799,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)if (current_fh->fh_export &&need_wrongsec_check (rqstp)) - op->status =check_nfsd_access (current_fh->fh_export, rqstp); + op->status =check_nfsd_access (current_fh->fh_export, rqstp, false); } encode_op:if (op->status == nfserr_replay_me) {
fs/nfsd/nfs4xdr.c +1 -1
@@ -3784,7 +3784,7 @@ nfsd4_encode_entry4_fattr(struct nfsd4_readdir *cd, const char *name, nfserr =nfserrno (err); goto out_put; } - nfserr =check_nfsd_access (exp, cd->rd_rqstp); + nfserr =check_nfsd_access (exp, cd->rd_rqstp, false);if (nfserr) goto out_put;
fs/nfsd/nfsfh.c +6 -3
@@ -320,6 +320,7 @@ __fh_verify(struct svc_rqst *rqstp, {struct nfsd_net *nn =net_generic (net, nfsd_net_id);struct svc_export *exp =NULL ; +bool may_bypass_gss = false;struct dentry *dentry;__be32 error;
@@ -367,8 +368,10 @@ __fh_verify(struct svc_rqst *rqstp,* which clients virtually always use auth_sys for, * even while using RPCSEC_GSS for NFS. */ -if (access &NFSD_MAY_LOCK || access &NFSD_MAY_BYPASS_GSS ) +if (access &NFSD_MAY_LOCK ) goto skip_pseudoflavor_check; +if (access &NFSD_MAY_BYPASS_GSS ) + may_bypass_gss = true;/* * Clients may expect to be able to use auth_sys during mount, * even if they use gss for everything else; see section 2.3.2
@@ -376,9 +379,9 @@ __fh_verify(struct svc_rqst *rqstp,*/ if (access &NFSD_MAY_BYPASS_GSS_ON_ROOT && exp->ex_path.dentry == dentry) - goto skip_pseudoflavor_check; + may_bypass_gss = true; - error =check_nfsd_access (exp, rqstp); + error =check_nfsd_access (exp, rqstp, may_bypass_gss);if (error) goto out;
fs/nfsd/vfs.c +1 -1
@@ -321,7 +321,7 @@ nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name, err =nfsd_lookup_dentry (rqstp, fhp, name, len, &exp, &dentry);if (err)return err; - err =check_nfsd_access (exp, rqstp); + err =check_nfsd_access (exp, rqstp, false);if (err) goto out;/*
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/5 NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
From: Chuck Lever <[email protected]>
[ Upstream commit 6640556b0c80edc66d6f50abe53f00311a873536 ]
NFSv4 LOCK operations should not avoid the set of authorization checks that apply to all other NFSv4 operations. Also, the "no_auth_nlm" export option should apply only to NLM LOCK requests. It's not necessary or sensible to apply it to NFSv4 LOCK operations.
Instead, set no permission bits when calling fh_verify(). Subsequent stateid processing handles authorization checks.
Stable-dep-of: 898374fdd7f0 ("nfsd: unregister with rpcbind when deleting a transport")
--- fs/nfsd/nfs4state.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfsd/nfs4state.c +2 -4
@@ -7998,11 +7998,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,if (check_lock_length (lock->lk_offset, lock->lk_length))return nfserr_inval; -if ((status =fh_verify (rqstp, &cstate->current_fh, -S_IFREG ,NFSD_MAY_LOCK ))) { -dprintk ("NFSD: nfsd4_lock: permission denied!\n" ); + status =fh_verify (rqstp, &cstate->current_fh,S_IFREG ,0 ); +if (status != nfs_ok)return status; - } sb = cstate->current_fh.fh_dentry->d_sb;if (lock->lk_is_new) {
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 3/5 nfsd: refine and rename NFSD_MAY_LOCK
In reply to Sasha LevinFrom: NeilBrown <[email protected]>
[ Upstream commit 4cc9b9f2bf4dfe13fe573da978e626e2248df388 ]
NFSD_MAY_LOCK means a few different things.
- it means that GSS is not required.
- it means that with NFSEXP_NOAUTHNLM, authentication is not required
- it means that OWNER_OVERRIDE is allowed.
None of these are specific to locking, they are specific to the NLM protocol.
So:
- rename to NFSD_MAY_NLM
- set NFSD_MAY_OWNER_OVERRIDE and NFSD_MAY_BYPASS_GSS in nlm_fopen() so that NFSD_MAY_NLM doesn't need to imply these.
- move the test on NFSEXP_NOAUTHNLM out of nfsd_permission() and into fh_verify where other special-case tests on the MAY flags happen. nfsd_permission() can be called from other places than fh_verify(), but none of these will have NFSD_MAY_NLM.
Stable-dep-of: 898374fdd7f0 ("nfsd: unregister with rpcbind when deleting a transport")
--- fs/nfsd/lockd.c | 13 +++++++++++-- fs/nfsd/nfsfh.c | 12 ++++-------- fs/nfsd/trace.h | 2 +- fs/nfsd/vfs.c | 12 +----------- fs/nfsd/vfs.h | 2 +- 5 files changed, 18 insertions(+), 23 deletions(-)
fs/nfsd/lockd.c +11 -2
@@ -38,11 +38,20 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp,memcpy (&fh.fh_handle.fh_raw, f->data, f->size); fh.fh_export =NULL ; +/* +* Allow BYPASS_GSS as some client implementations use AUTH_SYS +* for NLM even when GSS is used for NFS. +* Allow OWNER_OVERRIDE as permission might have been changed +* after the file was opened. +* Pass MAY_NLM so that authentication can be completely bypassed +* if NFSEXP_NOAUTHNLM is set. Some older clients use AUTH_NULL +* for NLM requests. +*/ access = (mode ==O_WRONLY ) ?NFSD_MAY_WRITE :NFSD_MAY_READ ; - access |=NFSD_MAY_LOCK ; + access |=NFSD_MAY_NLM |NFSD_MAY_OWNER_OVERRIDE |NFSD_MAY_BYPASS_GSS ; nfserr =nfsd_open (rqstp, &fh,S_IFREG , access, filp);fh_put (&fh); -/* We return nlm error codes as nlm doesn't know +/* We return nlm error codes as nlm doesn't know * about nfsd, but nfsd does know about nlm.. */ switch (nfserr) {
fs/nfsd/nfsfh.c +4 -8
@@ -363,13 +363,10 @@ __fh_verify(struct svc_rqst *rqstp,if (error) goto out; -/* -* pseudoflavor restrictions are not enforced on NLM, -* which clients virtually always use auth_sys for, -* even while using RPCSEC_GSS for NFS. -*/ -if (access &NFSD_MAY_LOCK ) - goto skip_pseudoflavor_check; +if ((access &NFSD_MAY_NLM ) && (exp->ex_flags &NFSEXP_NOAUTHNLM )) +/* NLM is allowed to fully bypass authentication */ + goto out; +if (access &NFSD_MAY_BYPASS_GSS ) may_bypass_gss = true;/*
@@ -385,7 +382,6 @@ __fh_verify(struct svc_rqst *rqstp,if (error) goto out; -skip_pseudoflavor_check:/* Finally, check access permissions. */ error =nfsd_permission (cred, exp, dentry, access); out:
fs/nfsd/trace.h +1 -1
@@ -79,7 +79,7 @@ DEFINE_NFSD_XDR_ERR_EVENT(cant_encode); { NFSD_MAY_READ, "READ" }, \ { NFSD_MAY_SATTR, "SATTR" }, \ { NFSD_MAY_TRUNC, "TRUNC" }, \ - { NFSD_MAY_LOCK, "LOCK" }, \ + { NFSD_MAY_NLM, "NLM" }, \ { NFSD_MAY_OWNER_OVERRIDE, "OWNER_OVERRIDE" }, \ { NFSD_MAY_LOCAL_ACCESS, "LOCAL_ACCESS" }, \ { NFSD_MAY_BYPASS_GSS_ON_ROOT, "BYPASS_GSS_ON_ROOT" }, \
fs/nfsd/vfs.c +1 -11
@@ -2519,7 +2519,7 @@ nfsd_permission(struct svc_cred *cred, struct svc_export *exp, (acc &NFSD_MAY_EXEC )?" exec" :"" , (acc &NFSD_MAY_SATTR )?" sattr" :"" , (acc &NFSD_MAY_TRUNC )?" trunc" :"" , - (acc &NFSD_MAY_LOCK )?" lock" :"" , + (acc &NFSD_MAY_NLM )?" nlm" :"" , (acc &NFSD_MAY_OWNER_OVERRIDE )?" owneroverride" :"" , inode->i_mode, IS_IMMUTABLE(inode)? " immut" : "",
@@ -2544,16 +2544,6 @@ nfsd_permission(struct svc_cred *cred, struct svc_export *exp,if ((acc &NFSD_MAY_TRUNC ) &&IS_APPEND (inode))return nfserr_perm; -if (acc &NFSD_MAY_LOCK ) { -/* If we cannot rely on authentication in NLM requests, -* just allow locks, otherwise require read permission, or -* ownership -*/ -if (exp->ex_flags &NFSEXP_NOAUTHNLM ) -return 0 ; -else - acc =NFSD_MAY_READ |NFSD_MAY_OWNER_OVERRIDE ; - }/* * The file owner always gets access permission for accesses that * would normally be checked at open time. This is to make
fs/nfsd/vfs.h +1 -1
@@ -20,7 +20,7 @@#define NFSD_MAY_READ 0x004/* == MAY_READ */ #define NFSD_MAY_SATTR 0x008#define NFSD_MAY_TRUNC 0x010 -#define NFSD_MAY_LOCK 0x020 +#define NFSD_MAY_NLM 0x020/* request is from lockd */ #define NFSD_MAY_MASK 0x03f/* extra hints to permission and open routines: */
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 4/5 nfsd: don't use sv_nrthreads in connection limiting calculations.
In reply to Sasha LevinFrom: NeilBrown <[email protected]>
[ Upstream commit eccbbc7c00a5aae5e704d4002adfaf4c3fa4b30d ]
The heuristic for limiting the number of incoming connections to nfsd currently uses sv_nrthreads - allowing more connections if more threads were configured.
A future patch will allow number of threads to grow dynamically so that there will be no need to configure sv_nrthreads. So we need a different solution for limiting connections.
It isn't clear what problem is solved by limiting connections (as mentioned in a code comment) but the most likely problem is a connection storm - many connections that are not doing productive work. These will be closed after about 6 minutes already but it might help to slow down a storm.
This patch adds a per-connection flag XPT_PEER_VALID which indicates that the peer has presented a filehandle for which it has some sort of access. i.e the peer is known to be trusted in some way. We now only count connections which have NOT been determined to be valid. There should be relative few of these at any given time.
If the number of non-validated peer exceed a limit - currently 64 - we close the oldest non-validated peer to avoid having too many of these useless connections.
Note that this patch significantly changes the meaning of the various configuration parameters for "max connections". The next patch will remove all of these.
Stable-dep-of: 898374fdd7f0 ("nfsd: unregister with rpcbind when deleting a transport")
--- fs/nfs/callback.c | 4 ---- fs/nfs/callback_xdr.c | 1 + fs/nfsd/netns.h | 4 ++-- fs/nfsd/nfsfh.c | 2 ++ include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_xprt.h | 16 ++++++++++++++++ net/sunrpc/svc_xprt.c | 32 ++++++++++++++++---------------- 7 files changed, 38 insertions(+), 23 deletions(-)
fs/nfs/callback.c +0 -4
@@ -211,10 +211,6 @@ static struct svc_serv *nfs_callback_create_svc(int minorversion)return ERR_PTR (-ENOMEM ); } cb_info->serv = serv; -/* As there is only one thread we need to over-ride the -* default maximum of 80 connections -*/ - serv->sv_maxconn =1024 ;dprintk ("nfs_callback_create_svc: service created\n" );return serv; }
fs/nfs/callback_xdr.c +1 -0
@@ -984,6 +984,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp)nfs_put_client (cps.clp); goto out_invalidcred; } +svc_xprt_set_valid (rqstp->rq_xprt); } cps.minorversion = hdr_arg.minorversion;
fs/nfsd/netns.h +2 -2
@@ -129,8 +129,8 @@ struct nfsd_net {unsigned char writeverf[8 ];/* -* Max number of connections this nfsd container will allow. Defaults -* to '0' which is means that it bases this on the number of threads. +* Max number of non-validated connections this nfsd container +* will allow. Defaults to '0' gets mapped to 64. */ unsigned int max_connections;
fs/nfsd/nfsfh.c +2 -0
@@ -382,6 +382,8 @@ __fh_verify(struct svc_rqst *rqstp,if (error) goto out; +svc_xprt_set_valid (rqstp->rq_xprt); +/* Finally, check access permissions. */ error =nfsd_permission (cred, exp, dentry, access); out:
include/linux/sunrpc/svc.h +1 -1
@@ -81,7 +81,7 @@ struct svc_serv {unsigned int sv_xdrsize;/* XDR buffer size */ struct list_head sv_permsocks;/* all permanent sockets */ struct list_head sv_tempsocks;/* all temporary sockets */ -int sv_tmpcnt;/* count of temporary sockets */ +int sv_tmpcnt;/* count of temporary "valid" sockets */ struct timer_list sv_temptimer;/* timer for aging temporary sockets */ char * sv_name;/* service name */
include/linux/sunrpc/svc_xprt.h +16 -0
@@ -99,8 +99,24 @@ enum {XPT_HANDSHAKE ,/* xprt requests a handshake */ XPT_TLS_SESSION ,/* transport-layer security established */ XPT_PEER_AUTH ,/* peer has been authenticated */ + XPT_PEER_VALID, /* peer has presented a filehandle that + * it has access to. It is NOT counted + * in ->sv_tmpcnt. + */ }; +static inline void svc_xprt_set_valid (struct svc_xprt *xpt) +{ +if (test_bit (XPT_TEMP , &xpt->xpt_flags) && + !test_and_set_bit (XPT_PEER_VALID , &xpt->xpt_flags)) { +struct svc_serv *serv = xpt->xpt_server; + +spin_lock (&serv->sv_lock); + serv->sv_tmpcnt -=1 ; +spin_unlock (&serv->sv_lock); + } +} +static inline void unregister_xpt_user (struct svc_xprt *xpt,struct svc_xpt_user *u) {spin_lock (&xpt->xpt_lock);
net/sunrpc/svc_xprt.c +16 -16
@@ -606,7 +606,8 @@ int svc_port_is_privileged(struct sockaddr *sin) }/* -* Make sure that we don't have too many active connections. If we have, +* Make sure that we don't have too many connections that have not yet +* demonstrated that they have access to the NFS server. If we have, * something must be dropped. It's not clear what will happen if we allow * "too many" connections, but when dealing with network-facing software, * we have to code defensively. Here we do that by imposing hard limits.
@@ -625,27 +626,25 @@ int svc_port_is_privileged(struct sockaddr *sin)*/ static void svc_check_conn_limits (struct svc_serv *serv) { -unsigned int limit = serv->sv_maxconn ? serv->sv_maxconn : - (serv->sv_nrthreads+3 ) *20 ; +unsigned int limit = serv->sv_maxconn ? serv->sv_maxconn :64 ;if (serv->sv_tmpcnt > limit) { -struct svc_xprt *xprt =NULL ; +struct svc_xprt *xprt =NULL , *xprti;spin_lock_bh (&serv->sv_lock);if (!list_empty (&serv->sv_tempsocks)) { -/* Try to help the admin */ -net_notice_ratelimited ("%s: too many open connections, consider increasing the %s\n" , - serv->sv_name, serv->sv_maxconn ? -"max number of connections" : -"number of threads" );/* * Always select the oldest connection. It's not fair, -* but so is life +* but nor is life. */ - xprt =list_entry (serv->sv_tempsocks.prev, - struct svc_xprt, - xpt_list); -set_bit (XPT_CLOSE , &xprt->xpt_flags); -svc_xprt_get (xprt); +list_for_each_entry_reverse (xprti, &serv->sv_tempsocks, + xpt_list) { +if (!test_bit (XPT_PEER_VALID , &xprti->xpt_flags)) { + xprt = xprti; +set_bit (XPT_CLOSE , &xprt->xpt_flags); +svc_xprt_get (xprt); +break ; + } + } }spin_unlock_bh (&serv->sv_lock);
@@ -1039,7 +1038,8 @@ static void svc_delete_xprt(struct svc_xprt *xprt)spin_lock_bh (&serv->sv_lock);list_del_init (&xprt->xpt_list); -if (test_bit (XPT_TEMP , &xprt->xpt_flags)) +if (test_bit (XPT_TEMP , &xprt->xpt_flags) && + !test_bit (XPT_PEER_VALID , &xprt->xpt_flags)) serv->sv_tmpcnt--;spin_unlock_bh (&serv->sv_lock);
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 5/5 nfsd: unregister with rpcbind when deleting a transport
In reply to Sasha LevinFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit 898374fdd7f06fa4c4a66e8be3135efeae6128d5 ]
When a listener is added, a part of creation of transport also registers program/port with rpcbind. However, when the listener is removed, while transport goes away, rpcbind still has the entry for that port/type.
When deleting the transport, unregister with rpcbind when appropriate.
---v2 created a new xpt_flag XPT_RPCB_UNREG to mark TCP and UDP transport and at xprt destroy send rpcbind unregister if flag set.
--- include/linux/sunrpc/svc_xprt.h | 3 +++ net/sunrpc/svc_xprt.c | 13 +++++++++++++ net/sunrpc/svcsock.c | 2 ++ 3 files changed, 18 insertions(+)
include/linux/sunrpc/svc_xprt.h +3 -0
@@ -103,6 +103,9 @@ enum {* it has access to. It is NOT counted * in ->sv_tmpcnt. */ + XPT_RPCB_UNREG, /* transport that needs unregistering +* with rpcbind (TCP, UDP) on destroy +*/ };static inline void svc_xprt_set_valid (struct svc_xprt *xpt)
net/sunrpc/svc_xprt.c +13 -0
@@ -1028,6 +1028,19 @@ static void svc_delete_xprt(struct svc_xprt *xprt)struct svc_serv *serv = xprt->xpt_server;struct svc_deferred_req *dr; +/* unregister with rpcbind for when transport type is TCP or UDP. +*/ +if (test_bit (XPT_RPCB_UNREG , &xprt->xpt_flags)) { + struct svc_sock *svsk = container_of(xprt, struct svc_sock, + sk_xprt); +struct socket *sock = svsk->sk_sock; + +if (svc_register (serv, xprt->xpt_net, sock->sk->sk_family, + sock->sk->sk_protocol,0 ) <0 ) +pr_warn ("failed to unregister %s with rpcbind\n" , + xprt->xpt_class->xcl_name); + } +if (test_and_set_bit (XPT_DEAD , &xprt->xpt_flags))return ;
net/sunrpc/svcsock.c +2 -0
@@ -837,6 +837,7 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)/* data might have come in before data_ready set up */ set_bit (XPT_DATA , &svsk->sk_xprt.xpt_flags);set_bit (XPT_CHNGBUF , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags);/* make sure we get destination address info */ switch (svsk->sk_sk->sk_family) {
@@ -1357,6 +1358,7 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)if (sk->sk_state ==TCP_LISTEN ) {strcpy (svsk->sk_xprt.xpt_remotebuf,"listener" );set_bit (XPT_LISTENER , &svsk->sk_xprt.xpt_flags); +set_bit (XPT_RPCB_UNREG , &svsk->sk_xprt.xpt_flags); sk->sk_data_ready = svc_tcp_listen_data_ready;set_bit (XPT_CONN , &svsk->sk_xprt.xpt_flags); }else {
Signature · 1 line
2.51.0