FAILED: patch "[PATCH] NFSD: Send a meaningful CB_RECALL_ANY keep count" failed to apply to 6.12-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 9af39c0773ef956039e1ebe9c235532fe6ee1e50
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026110416-cleat-grapple-d472@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9af39c0773ef956039e1ebe9c235532fe6ee1e50 Mon Sep 17 00:00:00 2001
From: Chuck Lever <[email protected]>
Date: Mon, 17 Aug 2026 21:08:39 -0400
Subject: [PATCH] NFSD: Send a meaningful CB_RECALL_ANY keep count
deleg_reaper() sets craa_objects_to_keep to zero on every CB_RECALL_ANY. RFC 8881 Section 20.6.3 defines that field as the number of objects the client may keep, leaving the client to choose which of the excess to return, because the server cannot read lack of recent use as lack of usefulness. Zero asks for every delegation the client holds, including the ones backing files an application still has open.
There is also no reason NFSD has to reclaim the entire delegation working set on the first sign of memory pressure.
Derive the keep count from cl_deleg_count so that each callback asks for one delegation. Both the shrinker and the laundromat re-arm while their condition lasts, so a client with more to give is asked again on the next pass.
The Linux client ignores craa_objects_to_keep and returns unused delegations selected from the type mask alone, so the count changes nothing for it.
fs/nfsd/nfs4state.c +16 -3
@@ -7959,6 +7959,7 @@ deleg_reaper(struct nfsd_net *nn) {struct list_head *pos, *next;struct nfs4_client *clp; +unsigned int count;spin_lock (&nn->client_lock);list_for_each_safe (pos, next, &nn->client_lru) {
@@ -7968,21 +7969,33 @@ deleg_reaper(struct nfsd_net *nn)continue ;if (clp->cl_state !=NFSD4_ACTIVE )continue ; -if (list_empty (&clp->cl_delegations)) -continue ;if (atomic_read (&clp->cl_delegs_in_recall))continue ;if (ktime_get_boottime_seconds () - clp->cl_ra_time <5 )continue ;if (clp->cl_cb_state !=NFSD4_CB_UP )continue ; +/* +* This read races with hash_delegation_locked() and +* unhash_delegation_locked() on other CPUs. A stale +* count only skews the keep value; the next +* laundromat pass sees a more current one. +*/ + count =data_race (READ_ONCE (clp->cl_deleg_count)); +if (!count) +continue ;if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &clp->cl_ra->ra_cb.cb_flags))continue ;/* release in nfsd4_cb_recall_any_release */ kref_get (&clp->cl_nfsdfs.cl_ref); clp->cl_ra_time =ktime_get_boottime_seconds (); - clp->cl_ra->ra_keep =0 ; +/* +* Ask for a single delegation. Recalling one before it +* is needed costs the client an OPEN when it next +* touches the file. +*/ + clp->cl_ra->ra_keep = count -1 ; clp->cl_ra->ra_bmval[0 ] =BIT (RCA4_TYPE_MASK_RDATA_DLG ) |BIT (RCA4_TYPE_MASK_WDATA_DLG ) |BIT (RCA4_TYPE_MASK_DIR_DLG );
Sasha Levin
maintainerPATCH 1/5 nfsd: prevent callback tasks running concurrently
From: Jeff Layton <[email protected]>
[ Upstream commit 1054e8ffc5c492f341bdf1888b882f1d163dd3d8 ]
The nfsd4_callback workqueue jobs exist to queue backchannel RPCs to rpciod. Because they run in different workqueue contexts, the rpc_task can run concurrently with the workqueue job itself, should it become requeued. This is problematic as there is no locking when accessing the fields in the nfsd4_callback.
Add a new unsigned long to nfsd4_callback and declare a new NFSD4_CALLBACK_RUNNING flag to be set in it. When attempting to run a workqueue job, do a test_and_set_bit() on that flag first, and don't queue the workqueue job if it returns true. Clear NFSD4_CALLBACK_RUNNING in nfsd41_destroy_cb().
This also gives us a more reliable mechanism for handling queueing failures in codepaths where we have to take references under spinlocks. We can now do the test_and_set_bit on NFSD4_CALLBACK_RUNNING first, and only take references to the objects if that returns false.
Most of the nfsd4_run_cb() callers are converted to use this new flag or the nfsd4_try_run_cb() wrapper. The main exception is the callback channel probe, which has its own synchronization.
Stable-dep-of: 9af39c0773ef ("NFSD: Send a meaningful CB_RECALL_ANY keep count")
--- fs/nfsd/nfs4callback.c | 2 ++ fs/nfsd/nfs4layouts.c | 7 ++++--- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4state.c | 14 ++++++++++---- fs/nfsd/state.h | 9 +++++++++ 5 files changed, 26 insertions(+), 8 deletions(-)
fs/nfsd/nfs4callback.c +2 -0
@@ -1227,6 +1227,7 @@ static void nfsd41_destroy_cb(struct nfsd4_callback *cb)trace_nfsd_cb_destroy (clp, cb);nfsd41_cb_release_slot (cb); +clear_bit (NFSD4_CALLBACK_RUNNING , &cb->cb_flags);if (cb->cb_ops && cb->cb_ops->release) cb->cb_ops->release (cb);nfsd41_cb_inflight_end (clp);
@@ -1575,6 +1576,7 @@ void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp, cb->cb_msg.rpc_proc = &nfs4_cb_procedures[op]; cb->cb_msg.rpc_argp = cb; cb->cb_msg.rpc_resp = cb; + cb->cb_flags =0 ; cb->cb_ops = ops;INIT_WORK (&cb->cb_work, nfsd4_run_cb_work); cb->cb_status =0 ;
fs/nfsd/nfs4layouts.c +4 -3
@@ -347,9 +347,10 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)atomic_inc (&ls->ls_stid.sc_file->fi_lo_recalls);trace_nfsd_layout_recall (&ls->ls_stid.sc_stateid); -refcount_inc (&ls->ls_stid.sc_count); -nfsd4_run_cb (&ls->ls_recall); - +if (!test_and_set_bit (NFSD4_CALLBACK_RUNNING , &ls->ls_recall.cb_flags)) { +refcount_inc (&ls->ls_stid.sc_count); +nfsd4_run_cb (&ls->ls_recall); + } out_unlock:spin_unlock (&ls->ls_lock); }
fs/nfsd/nfs4proc.c +1 -1
@@ -1769,7 +1769,7 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy) NFSPROC4_CLNT_CB_OFFLOAD);trace_nfsd_cb_offload (copy->cp_clp, &cbo->co_res.cb_stateid, &cbo->co_fh, copy->cp_count, copy->nfserr); -nfsd4_run_cb (&cbo->co_cb); +nfsd4_try_run_cb (&cbo->co_cb); }/**
fs/nfsd/nfs4state.c +10 -4
@@ -3303,8 +3303,10 @@ static void nfs4_cb_getattr(struct nfs4_cb_fattr *ncf)/* set to proper status when nfsd4_cb_getattr_done runs */ ncf->ncf_cb_status =NFS4ERR_IO ; -refcount_inc (&dp->dl_stid.sc_count); -nfsd4_run_cb (&ncf->ncf_getattr); +if (!test_and_set_bit (NFSD4_CALLBACK_RUNNING , &ncf->ncf_getattr.cb_flags)) { +refcount_inc (&dp->dl_stid.sc_count); +nfsd4_run_cb (&ncf->ncf_getattr); + } } static struct nfs4_client *create_client(struct xdr_netobj name,
@@ -5477,6 +5479,10 @@ static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = {static void nfsd_break_one_deleg (struct nfs4_delegation *dp) {bool queued; + +if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &dp->dl_recall.cb_flags)) +return ; +/* * We're assuming the state code never drops its reference * without first removing the lease. Since we're in this lease
@@ -7036,7 +7042,7 @@ deleg_reaper(struct nfsd_net *nn) clp->cl_ra->ra_bmval[0 ] =BIT (RCA4_TYPE_MASK_RDATA_DLG ) |BIT (RCA4_TYPE_MASK_WDATA_DLG );trace_nfsd_cb_recall_any (clp->cl_ra); -nfsd4_run_cb (&clp->cl_ra->ra_cb); +nfsd4_try_run_cb (&clp->cl_ra->ra_cb); } }
@@ -7977,7 +7983,7 @@ nfsd4_lm_notify(struct file_lock *fl)if (queue) {trace_nfsd_cb_notify_lock (lo, nbl); -nfsd4_run_cb (&nbl->nbl_cb); +nfsd4_try_run_cb (&nbl->nbl_cb); } }
fs/nfsd/state.h +9 -0
@@ -67,6 +67,8 @@ typedef struct {struct nfsd4_callback {struct nfs4_client *cb_clp;struct rpc_message cb_msg; +#define NFSD4_CALLBACK_RUNNING (0) +unsigned long cb_flags;const struct nfsd4_callback_ops *cb_ops;struct work_struct cb_work;int cb_seq_status;
@@ -748,6 +750,13 @@ extern void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *extern void nfsd4_init_cb (struct nfsd4_callback *cb,struct nfs4_client *clp,const struct nfsd4_callback_ops *ops,enum nfsd4_cb_op op);extern bool nfsd4_run_cb (struct nfsd4_callback *cb); + +static inline void nfsd4_try_run_cb (struct nfsd4_callback *cb) +{ +if (!test_and_set_bit (NFSD4_CALLBACK_RUNNING , &cb->cb_flags)) +WARN_ON_ONCE (!nfsd4_run_cb (cb)); +} +extern void nfsd4_shutdown_callback (struct nfs4_client *);extern void nfsd4_shutdown_copy (struct nfs4_client *clp); extern struct nfs4_client_reclaim *nfs4_client_to_reclaim(struct xdr_netobj name,
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/5 nfsd: eliminate cl_ra_cblist and NFSD4_CLIENT_CB_RECALL_ANY
From: Jeff Layton <[email protected]>
[ Upstream commit 424dd3df1f991b14a70f044a68c8a595abbdf1ad ]
deleg_reaper() will walk the client_lru list and put any suitable entries onto "cblist" using the cl_ra_cblist pointer. It then walks the objects outside the spinlock and queues callbacks for them.
None of the operations that deleg_reaper() does outside the nn->client_lock are blocking operations. Just queue their workqueue jobs under the nn->client_lock instead.
Also, the NFSD4_CLIENT_CB_RECALL_ANY and NFSD4_CALLBACK_RUNNING flags serve an identical purpose now. Drop the NFSD4_CLIENT_CB_RECALL_ANY flag and just use the one in the callback.
Stable-dep-of: 9af39c0773ef ("NFSD: Send a meaningful CB_RECALL_ANY keep count")
--- fs/nfsd/nfs4state.c | 16 +++------------- fs/nfsd/state.h | 2 -- 2 files changed, 3 insertions(+), 15 deletions(-)
fs/nfsd/nfs4state.c +3 -13
@@ -3246,7 +3246,6 @@ nfsd4_cb_recall_any_release(struct nfsd4_callback *cb) {struct nfs4_client *clp = cb->cb_clp; -clear_bit (NFSD4_CLIENT_CB_RECALL_ANY , &clp->cl_flags);drop_client (clp); }
@@ -7005,7 +7004,6 @@ deleg_reaper(struct nfsd_net *nn) {struct list_head *pos, *next;struct nfs4_client *clp; -LIST_HEAD (cblist);spin_lock (&nn->client_lock);list_for_each_safe (pos, next, &nn->client_lru) {
@@ -7019,31 +7017,23 @@ deleg_reaper(struct nfsd_net *nn)continue ;if (atomic_read (&clp->cl_delegs_in_recall))continue ; -if (test_bit (NFSD4_CLIENT_CB_RECALL_ANY , &clp->cl_flags)) +if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &clp->cl_ra->ra_cb.cb_flags))continue ;if (ktime_get_boottime_seconds () - clp->cl_ra_time <5 )continue ;if (clp->cl_cb_state !=NFSD4_CB_UP )continue ; -list_add (&clp->cl_ra_cblist, &cblist);/* release in nfsd4_cb_recall_any_release */ kref_get (&clp->cl_nfsdfs.cl_ref); -set_bit (NFSD4_CLIENT_CB_RECALL_ANY , &clp->cl_flags); clp->cl_ra_time =ktime_get_boottime_seconds (); - } -spin_unlock (&nn->client_lock); - -while (!list_empty (&cblist)) { - clp = list_first_entry(&cblist, struct nfs4_client, - cl_ra_cblist); -list_del_init (&clp->cl_ra_cblist); clp->cl_ra->ra_keep =0 ; clp->cl_ra->ra_bmval[0 ] =BIT (RCA4_TYPE_MASK_RDATA_DLG ) |BIT (RCA4_TYPE_MASK_WDATA_DLG );trace_nfsd_cb_recall_any (clp->cl_ra); -nfsd4_try_run_cb (&clp->cl_ra->ra_cb); +nfsd4_run_cb (&clp->cl_ra->ra_cb); } +spin_unlock (&nn->client_lock); } static void
fs/nfsd/state.h +0 -2
@@ -412,7 +412,6 @@ struct nfs4_client {#define NFSD4_CLIENT_UPCALL_LOCK (5)/* upcall serialization */ #define NFSD4_CLIENT_CB_FLAG_MASK (1 << NFSD4_CLIENT_CB_UPDATE | \ 1 << NFSD4_CLIENT_CB_KILL) -#define NFSD4_CLIENT_CB_RECALL_ANY (6)unsigned long cl_flags;struct workqueue_struct *cl_callback_wq;
@@ -461,7 +460,6 @@ struct nfs4_client {struct nfsd4_cb_recall_any *cl_ra;time64_t cl_ra_time; -struct list_head cl_ra_cblist; };/* struct nfs4_client_reset
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/5 nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
In reply to Sasha LevinFrom: Jeff Layton <[email protected]>
[ Upstream commit 108969960dc54de673869814c5f37c22f6cf404a ]
deleg_reaper() sets NFSD4_CALLBACK_RUNNING before checking the 5-second rate limit and cl_cb_state gates. When either gate fires the loop continues without queuing callback work, so the bit's only clear site in nfsd41_destroy_cb() is never reached and RECALL_ANY dispatch is permanently disabled for the affected client.
Move the test_and_set_bit() below both non-queueing gates so the bit is taken only when nfsd4_run_cb() will be called.
Stable-dep-of: 9af39c0773ef ("NFSD: Send a meaningful CB_RECALL_ANY keep count")
--- fs/nfsd/nfs4state.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4state.c +2 -2
@@ -7017,12 +7017,12 @@ deleg_reaper(struct nfsd_net *nn)continue ;if (atomic_read (&clp->cl_delegs_in_recall))continue ; -if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &clp->cl_ra->ra_cb.cb_flags)) -continue ;if (ktime_get_boottime_seconds () - clp->cl_ra_time <5 )continue ;if (clp->cl_cb_state !=NFSD4_CB_UP )continue ; +if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &clp->cl_ra->ra_cb.cb_flags)) +continue ;/* release in nfsd4_cb_recall_any_release */ kref_get (&clp->cl_nfsdfs.cl_ref);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 4/5 NFSD: Count the delegations held by each client
In reply to Sasha LevinFrom: Chuck Lever <[email protected]>
[ Upstream commit 5d5a6e996e7c36bc2f7b035743c16f2bf03a227d ]
struct nfs4_client records the delegations it holds on cl_delegations but keeps no count of them. deleg_reaper() walks nn->client_lru under nn->client_lock, but cl_delegations is serialized by nn->deleg_lock, which nests outside nn->client_lock. A caller there cannot take nn->deleg_lock to count the list. The cost tells against the walk as
well: an O(n) count per client, on a pass that already visits every client.
Add cl_deleg_count, maintained at the two sites that mutate cl_delegations. Both hold nn->deleg_lock, so the counter is already serialized against itself and needs no atomic of its own. The decrement sits below the delegation_hashed() test, next to the list_del_init it pairs with, so it runs only when the delegation really leaves the list.
A reader that holds only nn->client_lock is not synchronized against either update site, so it can see a count that does not match the list. Such a reader marks the access with data_race() and may not depend on the value for correctness.
No functional change.
Stable-dep-of: 9af39c0773ef ("NFSD: Send a meaningful CB_RECALL_ANY keep count")
--- fs/nfsd/nfs4state.c | 2 ++ fs/nfsd/state.h | 2 ++ 2 files changed, 4 insertions(+)
fs/nfsd/nfs4state.c +2 -0
@@ -1420,6 +1420,7 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) dp->dl_stid.sc_type =SC_TYPE_DELEG ;list_add (&dp->dl_perfile, &fp->fi_delegations);list_add (&dp->dl_perclnt, &clp->cl_delegations); + clp->cl_deleg_count++;return 0 ; }
@@ -1451,6 +1452,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp, unsigned short statusmask) ++dp->dl_time;spin_lock (&fp->fi_lock);list_del_init (&dp->dl_perclnt); + dp->dl_stid.sc_client->cl_deleg_count--;list_del_init (&dp->dl_recall_lru);list_del_init (&dp->dl_perfile);spin_unlock (&fp->fi_lock);
fs/nfsd/state.h +2 -0
@@ -457,6 +457,8 @@ struct nfs4_client {unsigned int cl_state;atomic_t cl_delegs_in_recall; +/* Length of cl_delegations, updated under nn->deleg_lock */ +unsigned int cl_deleg_count;struct nfsd4_cb_recall_any *cl_ra;time64_t cl_ra_time;
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 5/5 NFSD: Send a meaningful CB_RECALL_ANY keep count
In reply to Sasha LevinFrom: Chuck Lever <[email protected]>
[ Upstream commit 9af39c0773ef956039e1ebe9c235532fe6ee1e50 ]
deleg_reaper() sets craa_objects_to_keep to zero on every CB_RECALL_ANY. RFC 8881 Section 20.6.3 defines that field as the number of objects the client may keep, leaving the client to choose which of the excess to return, because the server cannot read lack of recent use as lack of usefulness. Zero asks for every delegation the client holds, including the ones backing files an application still has open.
There is also no reason NFSD has to reclaim the entire delegation working set on the first sign of memory pressure.
Derive the keep count from cl_deleg_count so that each callback asks for one delegation. Both the shrinker and the laundromat re-arm while their condition lasts, so a client with more to give is asked again on the next pass.
The Linux client ignores craa_objects_to_keep and returns unused delegations selected from the type mask alone, so the count changes nothing for it.
--- fs/nfsd/nfs4state.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
fs/nfsd/nfs4state.c +16 -3
@@ -7006,6 +7006,7 @@ deleg_reaper(struct nfsd_net *nn) {struct list_head *pos, *next;struct nfs4_client *clp; +unsigned int count;spin_lock (&nn->client_lock);list_for_each_safe (pos, next, &nn->client_lru) {
@@ -7015,21 +7016,33 @@ deleg_reaper(struct nfsd_net *nn)continue ;if (clp->cl_state !=NFSD4_ACTIVE )continue ; -if (list_empty (&clp->cl_delegations)) -continue ;if (atomic_read (&clp->cl_delegs_in_recall))continue ;if (ktime_get_boottime_seconds () - clp->cl_ra_time <5 )continue ;if (clp->cl_cb_state !=NFSD4_CB_UP )continue ; +/* +* This read races with hash_delegation_locked() and +* unhash_delegation_locked() on other CPUs. A stale +* count only skews the keep value; the next +* laundromat pass sees a more current one. +*/ + count =data_race (READ_ONCE (clp->cl_deleg_count)); +if (!count) +continue ;if (test_and_set_bit (NFSD4_CALLBACK_RUNNING , &clp->cl_ra->ra_cb.cb_flags))continue ;/* release in nfsd4_cb_recall_any_release */ kref_get (&clp->cl_nfsdfs.cl_ref); clp->cl_ra_time =ktime_get_boottime_seconds (); - clp->cl_ra->ra_keep =0 ; +/* +* Ask for a single delegation. Recalling one before it +* is needed costs the client an OPEN when it next +* touches the file. +*/ + clp->cl_ra->ra_keep = count -1 ; clp->cl_ra->ra_bmval[0 ] =BIT (RCA4_TYPE_MASK_RDATA_DLG ) |BIT (RCA4_TYPE_MASK_WDATA_DLG );trace_nfsd_cb_recall_any (clp->cl_ra);
Signature · 1 line
2.53.0