Skip to content

mountd/exportd: exit signal handling fixups

Benjamin Coddington linux-nfs 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest4 patches 1 replyIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/4support/export: take SIGINT/SIGTERM/SIGHUP via signalfdsupport/export/cache.c support/export/export.h support/include/ha-callout.h+127 -20 replies
2/4mountd: stop exiting from a signal handlerutils/mountd/mountd.c utils/mountd/svc_run.c+8 -190 replies
3/4exportd: stop exiting from a signal handlerutils/exportd/exportd.c+9 -210 replies
4/4mountd: hold SIGTERM during rpcbind registration instead of ignoring itutils/mountd/mountd.c+4 -50 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/4] mountd/exportd: exit signal handling fixups

mountd and exportd exit from inside their SIGTERM handler: killer() unregisters with rpcbind, frees, logs and calls exit(), none of which is async-signal-safe. It mostly gets away with it because mountd spends nearly all its time in select().

Setting rootdir in the [exports] section of nfs.conf makes it much easier to hit. nfsd_path_init() then starts a workqueue thread to do path lookups in the chroot, and it does that after killer() is installed. pthread_create() allocates the new thread's TLS with calloc(), so a SIGTERM there - say, from a reboot while mountd is still coming up - runs killer() on top of a half-finished malloc. We hit this in a reboot test:

malloc(): unsorted double linked list corrupted
...
calloc
clnt_vc_create
local_rpcb
rpcb_unset
nfs_svc_unregister
unregister_services
killer
<signal handler called>
_int_malloc
calloc
allocate_dtv
_dl_allocate_tls
pthread_create
main

Once that thread exists malloc takes the arena lock, so the same re-entry later can deadlock instead of aborting. Out of 400 SIGTERMs sent during startup with rootdir set, one mountd hung on a futex, which I think is that, though I didn't catch a stack.

These patches take HUP, INT and TERM through a signalfd in the cache loop, so the shutdown work runs in normal context. The parent of forked workers keeps a handler, but all it does is kill(0, SIGTERM). The last patch holds signals while mountd registers with rpcbind rather than ignoring them; a SIGTERM there used to just get dropped.

Tested in a private net namespace with its own rpcbind: foreground and -t 4, HUP, TERM, an ha-callout, and 400 SIGTERMs at random points in startup with rootdir set. No aborts or hangs, and nothing dropped.

Benjamin Coddington (4):
support/export: take SIGINT/SIGTERM/SIGHUP via signalfd
mountd: stop exiting from a signal handler
exportd: stop exiting from a signal handler
mountd: hold SIGTERM during rpcbind registration instead of ignoring
it

 support/export/cache.c       | 122 ++++++++++++++++++++++++++++++++++-
 support/export/export.h      |   2 +
 support/include/ha-callout.h |   5 +-
 utils/exportd/exportd.c      |  30 +++------
 utils/mountd/mountd.c        |  32 +++------
 utils/mountd/svc_run.c       |   2 +
 6 files changed, 147 insertions(+), 46 deletions(-)
Signature · 1 line
2.53.0