This version fixes a number of problems that Sashiko pointed out. The
more serious ones were preexisting issues, but we might as well fix
them while we're in the area. As before, the real way to address the
issues that syzbot keeps reporting is to make the rpcbind calls run
asynchronously.
syzbot keeps landing in nfsd_nl_listener_set_doit(), where a stall under
nfsd_mutex blocks every other NFSD netlink op. This is hardening rather than
a fix for any one report: it narrows what userland can push into that path
and shortens the worst stalls.
1: reject transport names NFSD cannot instantiate, before nfsd_mutex is
taken
2: cap a listener_set request at 1024 entries
3: stop svc_register() losing a registration error to a later program
4: undo the registrations svc_register() made before it failed
5: bound the local rpcbind client to a single 1s attempt
6: report listener creation failures through extack
7: listener_set validation tests
8: a per-netns rpcbind stub, and the listener round-trip tests
Measured against a local rpcbind that accepts the connection and never
replies. The wait is paid per listener, since svc_xprt_create_from_sa()
passes flags of 0 and every listener therefore calls svc_register():
per rpcbind call 10s AF_LOCAL, 60s loopback TCP -> 1s
per listener 20s / 120s -> 2s
entries/request bounded only by message size -> 1024
worst request unbounded -> ~34min
Three things this does not do:
- "rdma" is still accepted, so 1024 entries can still mean 1024
request_module("svcrdma") upcalls under nfsd_mutex where svcrdma is
unavailable. Not counted above.
- write_ports() reaches the same code with the same mutex held. It is
legacy, so it is left alone.
- ~34min is still ~17x the hung-task threshold, so the reproducer should be
expected to keep tripping the watchdog. The durable fix is to make rpcbind
registration asynchronous so those RPCs stop running under nfsd_mutex at
all. That needs behavioural changes we should discuss first, so it is a
separate patchset.
Patch 3 is a flag day for CONFIG_NFS_LOCALIO=y: a registration failure now
aborts listener creation there too, matching CONFIG_NFS_LOCALIO=n. Details
in that patch.
Please consider these for v7.4.
To: Chuck Lever <[email protected]>
To: NeilBrown <[email protected]>
To: Olga Kornievskaia <[email protected]>
To: Dai Ngo <[email protected]>
To: Tom Talpey <[email protected]>
To: Trond Myklebust <[email protected]>
To: Anna Schumaker <[email protected]>
To: David S. Miller <[email protected]>
To: Eric Dumazet <[email protected]>
To: Jakub Kicinski <[email protected]>
To: Paolo Abeni <[email protected]>
To: Simon Horman <[email protected]>
To: J. Bruce Fields <[email protected]>
To: Shuah Khan <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: Trond Myklebust <[email protected]>
Cc: [email protected]
Signed-off-by: Jeff Layton <[email protected]>
--- Changes in v2:
- New patch 4: svc_register() left the entries it had already set in
rpcbind when a later one failed, pointing at a port the caller then
closed.
- Tests: Behavioral fixes for several tests: several assertions only
checked an errno that both the fixed and the broken kernel return.
val_bad_transport() now requires that the rpcbind stub saw no traffic,
val_second_entry_bad() that no listener came up, func_empty_destroys
that the local rpcbind client was dropped and had to reconnect, and the
two -EBUSY tests that the listener set is unchanged. find_listener()
matches the address too.
- Tests: the stub read the revents of a freshly accepted pollfd that
poll() had not written, so it could enter a blocking read with no
readiness event.
- Tests: the config fragment gained NAMESPACES, SHMEM, TMPFS and UNIX;
without them every test skipped.
- Link to v1:
https://lore.kernel.org/r/[email protected]
---
Jeff Layton (8):
NFSD: validate transport name in listener_set before serv creation
NFSD: cap the number of listeners accepted in listener_set
SUNRPC: keep the first error in svc_register()
SUNRPC: undo partial rpcbind registrations when svc_register() fails
SUNRPC: bound the local rpcbind client timeout to 1s
NFSD: report listener creation failures through extack
selftests/nfsd: exercise listener_set request validation
selftests/nfsd: add a per-netns rpcbind stub and the listener round-trips
fs/nfsd/nfsctl.c | 42 +-
net/sunrpc/rpcb_clnt.c | 12 +
net/sunrpc/svc.c | 40 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/nfsd/.gitignore | 1 +
tools/testing/selftests/nfsd/Makefile | 6 +
tools/testing/selftests/nfsd/config | 8 +
.../testing/selftests/nfsd/nfsd_netlink_listener.c | 1030 ++++++++++++++++++++
tools/testing/selftests/nfsd/settings | 1 +
9 files changed, 1131 insertions(+), 10 deletions(-)
---
base-commit: 0b6d2c7e3abca8d17fddeecb6e4c32a8438ec2fb
change-id: 20260717-nfsd-nl-hang-10a3b3e93f2a
Best regards,
--
Jeff Layton <[email protected]>
