diff options
| author | Zhang Xiaoxu <zhangxiaoxu5@huawei.com> | 2021-06-26 15:50:41 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-20 16:20:57 +0200 |
| commit | a08048fdf238bfe1e8883d15bf21d47edf5c9b2a (patch) | |
| tree | 39bcdfa6655b43bd17f36902d5142521a3987416 /net | |
| parent | 7c6ae37aee82a93a54acdc940be4aea0b8e26e45 (diff) | |
| download | linux-a08048fdf238bfe1e8883d15bf21d47edf5c9b2a.tar.gz linux-a08048fdf238bfe1e8883d15bf21d47edf5c9b2a.tar.bz2 linux-a08048fdf238bfe1e8883d15bf21d47edf5c9b2a.zip | |
SUNRPC: Fix the batch tasks count wraparound.
commit fcb170a9d825d7db4a3fb870b0300f5a40a8d096 upstream.
The 'queue->nr' will wraparound from 0 to 255 when only current
priority queue has tasks. This maybe lead a deadlock same as commit
dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):
Privileged delegreturn task is queued to privileged list because all
the slots are assigned. When non-privileged task complete and release
the slot, a non-privileged maybe picked out. It maybe allocate slot
failed when the session on draining.
If the 'queue->nr' has wraparound to 255, and no enough slot to
service it, then the privileged delegreturn will lost to wake up.
So we should avoid the wraparound on 'queue->nr'.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sunrpc/sched.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c index 0ef65822fdd3..577e93c29deb 100644 --- a/net/sunrpc/sched.c +++ b/net/sunrpc/sched.c @@ -490,7 +490,8 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q * Service a batch of tasks from a single owner. */ q = &queue->tasks[queue->priority]; - if (!list_empty(q) && --queue->nr) { + if (!list_empty(q) && queue->nr) { + queue->nr--; task = list_first_entry(q, struct rpc_task, u.tk_wait.list); goto out; } |