Public bug reported: After upgrading our NFS server (Noble, linux-image-generic) from 6.8.0-147 to 6.8.0-149, every NFSv4.2 server-side COPY large enough to run asynchronously hangs forever on the client. The server completes the copy (the destination file is complete and byte-identical), but the client never returns from copy_file_range(): it waits in handle_async_copy / nfs42_proc_copy indefinitely. Booting the server back into 6.8.0-147 fixes it immediately. The clients (Noble 6.8.0-149 and AlmaLinux 8 4.18) work fine once the server runs 147, so the fault is server-side.
Cause: 6.8.0-148 picked up "nfsd: fix stale s2s_cp_stateids IDR entry for async COPY" (upstream 14b978e8d05c) through the upstream stable patchset. After that change, nfsd4_copy() calls dup_copy_fields() before the copy stateid is created, so async_copy->cp_res.cb_stateid stays zero and nfsd4_send_cb_offload() sends CB_OFFLOAD with an all-zero stateid. The client cannot match it to its pending COPY. Upstream fix: "nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY" (Lubos Rendek), released in 7.2.12 and posted for 6.18.y: - https://lkml.iu.edu/2610.1/16590.html (7.2.y) - https://lkml.iu.edu/hypermail/linux/kernel/2610.1/19037.html (6.18.y) - https://lwn.net/Articles/1101759 (7.2.12 release) Mainline fixed it in v7.3 as part of f307b4f7ed17 ("nfsd: split nfsd4_copy into transient and durable async copy objects"), which upstream considers too risky to backport. The same backport is in linux 7.0.0-39 through 7.0.0-43 (resolute, and linux-hwe-7.0 on noble), so those are expected to be affected too. Reproducer, on an NFSv4.2 client (mount vers=4.2) of a server running 6.8.0-148 or -149: head -c 10000000 /dev/urandom > /mnt/nfs/src.bin python3 -c 'import os; s=os.open("/mnt/nfs/src.bin", os.O_RDONLY); d=os.open("/mnt/nfs/dst.bin", os.O_WRONLY|os.O_CREAT|os.O_TRUNC, 0o644); print(os.copy_file_range(s, d, 10000000))' The call hangs (wchan handle_async_copy) and only kill -9 ends it. Copies up to 2 x rsize are done synchronously and still work. cp(1) from coreutils 9.4 and PHP 8.4 copy() hang the same way. On the server, the COPY and OFFLOAD_CANCEL counters in /proc/net/rpc/nfsd increase, and no copy kthread is left running. Workarounds: boot the server into 6.8.0-147, or mount clients with vers=4.1 (no server-side COPY). Note: this report was collected while the server runs 6.8.0-147 (rolled back). The affected version is 6.8.0-149.149 (and 6.8.0-148.148). ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-147-generic 6.8.0-147.147 ProcVersionSignature: Ubuntu 6.8.0-147.147-generic 6.8.12 Uname: Linux 6.8.0-147-generic x86_64 AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-147-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/midiC0D0', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CRDA: N/A Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: unknown CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted Date: Sun Nov 8 19:56:14 2026 HibernationDevice: RESUME=UUID=bc9db53a-e37f-4aa2-b030-abf4921a2356 Lsusb: Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet Lsusb-t: /: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=uhci_hcd/2p, 12M |__ Port 001: Dev 002, If 0, Class=Human Interface Device, Driver=usbhid, 12M MachineType: QEMU Standard PC (i440FX + PIIX, 1996) ProcFB: 0 bochs-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-147-generic root=UUID=ec329059-76f7-4a6c-bea7-be27e0109b2d ro zswap.enabled=1 zswap.compressor=lz4 elevator=noop RelatedPackageVersions: linux-restricted-modules-6.8.0-147-generic N/A linux-backports-modules-6.8.0-147-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: Upgraded to noble on 2024-11-21 (717 days ago) WifiSyslog: acpidump: Error: [Errno 2] No such file or directory: '/usr/share/apport/dump_acpi_tables.py' dmi.bios.date: 04/01/2014 dmi.bios.release: 0.0 dmi.bios.vendor: SeaBIOS dmi.bios.version: rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org dmi.chassis.type: 1 dmi.chassis.vendor: QEMU dmi.chassis.version: pc-i440fx-7.2 dmi.modalias: dmi:bvnSeaBIOS:bvrrel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org:bd04/01/2014:br0.0:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-7.2:cvnQEMU:ct1:cvrpc-i440fx-7.2:sku: dmi.product.name: Standard PC (i440FX + PIIX, 1996) dmi.product.version: pc-i440fx-7.2 dmi.sys.vendor: QEMU ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug kernel-fixed-upstream noble regression-update ** Attachment added: "Note: this report was collected while the server runs 6.8.0-147 (rolled back). The affected version is 6.8.0-149.149 (and 6.8.0-148.148)." https://bugs.launchpad.net/bugs/2173704/+attachment/6016129/+files/apport.linux-image-6.8.0-147-generic.leyvuvv1.apport ** Tags added: kernel-fixed-upstream regression-update -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2173704 Title: nfsd: async NFSv4.2 COPY never completes (CB_OFFLOAD sent with all- zero stateid) since 6.8.0-148 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173704/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
