Re: [Bug 197817] "Panic: unable to handle kernel page request" in posix_unblock_lock() called from nfs4_laundromat()

Re: [Bug 197817] "Panic: unable to handle kernel page request" in posix_unblock_lock() called from nfs4_laundromat()

[Naofumi Honda]

[-- Attachment #1.1: Type: text/plain, Size: 559 bytes --]

Dear Developers:

> https://bugzilla.kernel.org/show_bug.cgi?id=197817
> 
> --- Comment #1 from bfields@fieldses.org ---
> Yes, I think you're right.
> 
> Would it be possible for you to submit a patch to fix that typo in those two
> places?  (Just mail it to me at bfields@fieldses.org, cc: to
> linux-nfs@vger.kernel.org).
> 

OK,  I have attached the patch.

> It might also be useful to see your original oops.

Sorry, I have the only handwriting memo of console messages.
Maybe useless, but I also attach its scanned copy.

Sincerely yours
Naofumi Honda

[-- Attachment #1.2: oops_memo.pdf --]
[-- Type: application/pdf, Size: 40725 bytes --]

[-- Attachment #1.3: fix.patch --]
[-- Type: text/x-patch, Size: 1228 bytes --]

*** linux-4.9.60/fs/nfsd/nfs4state.c.org	2017-11-09 09:49:11.071026183 +0900
--- linux-4.9.60/fs/nfsd/nfs4state.c	2017-11-09 09:51:36.370697280 +0900
***************
*** 4677,4683 ****
  	spin_unlock(&nn->blocked_locks_lock);
  
  	while (!list_empty(&reaplist)) {
! 		nbl = list_first_entry(&nn->blocked_locks_lru,
  					struct nfsd4_blocked_lock, nbl_lru);
  		list_del_init(&nbl->nbl_lru);
  		posix_unblock_lock(&nbl->nbl_lock);
--- 4677,4683 ----
  	spin_unlock(&nn->blocked_locks_lock);
  
  	while (!list_empty(&reaplist)) {
! 		nbl = list_first_entry(&reaplist,
  					struct nfsd4_blocked_lock, nbl_lru);
  		list_del_init(&nbl->nbl_lru);
  		posix_unblock_lock(&nbl->nbl_lock);
***************
*** 7071,7077 ****
  	spin_unlock(&nn->blocked_locks_lock);
  
  	while (!list_empty(&reaplist)) {
! 		nbl = list_first_entry(&nn->blocked_locks_lru,
  					struct nfsd4_blocked_lock, nbl_lru);
  		list_del_init(&nbl->nbl_lru);
  		posix_unblock_lock(&nbl->nbl_lock);
--- 7071,7077 ----
  	spin_unlock(&nn->blocked_locks_lock);
  
  	while (!list_empty(&reaplist)) {
! 		nbl = list_first_entry(&reaplist,
  					struct nfsd4_blocked_lock, nbl_lru);
  		list_del_init(&nbl->nbl_lru);
  		posix_unblock_lock(&nbl->nbl_lock);

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [Bug 197817] "Panic: unable to handle kernel page request" in posix_unblock_lock() called from nfs4_laundromat()

[J. Bruce Fields]

On Thu, Nov 09, 2017 at 10:08:28AM +0900, Naofumi Honda wrote:
> Dear Developers:
> 
> > https://bugzilla.kernel.org/show_bug.cgi?id=197817
> > 
> > --- Comment #1 from bfields@fieldses.org ---
> > Yes, I think you're right.
> > 
> > Would it be possible for you to submit a patch to fix that typo in those two
> > places?  (Just mail it to me at bfields@fieldses.org, cc: to
> > linux-nfs@vger.kernel.org).
> > 
> 
> OK,  I have attached the patch.

Thanks for the investigation and the fix!

For future reference, we prefer patches to be inline with the email
message (not attached), and prefer them in "unified" format.

But for a one-off patch I can fix it up myself; applied as follows.

--b.

commit c26806a20fa3
Author: Naofumi Honda <honda@math.sci.hokudai.ac.jp>
Date:   Thu Nov 9 10:57:16 2017 -0500

    nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
    
    From kernel 4.9, my two nfsv4 servers sometimes suffer from
        "panic: unable to handle kernel page request"
    in posix_unblock_lock() called from nfs4_laundromat().
    
    These panics diseappear if we revert the commit "nfsd: add a LRU list
    for blocked locks".
    
    The cause appears to be a typo in nfs4_laundromat(), which is also
    present in nfs4_state_shutdown_net().
    
    Cc: stable@vger.kernel.org
    Fixes: 7919d0a27f1e "nfsd: add a LRU list for blocked locks"
    Cc: jlayton@redhat.com
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 923243369bbc..b99830ab63aa 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4791,7 +4791,7 @@ nfs4_laundromat(struct nfsd_net *nn)
 	spin_unlock(&nn->blocked_locks_lock);
 
 	while (!list_empty(&reaplist)) {
-		nbl = list_first_entry(&nn->blocked_locks_lru,
+		nbl = list_first_entry(&reaplist,
 					struct nfsd4_blocked_lock, nbl_lru);
 		list_del_init(&nbl->nbl_lru);
 		posix_unblock_lock(&nbl->nbl_lock);
@@ -7260,7 +7260,7 @@ nfs4_state_shutdown_net(struct net *net)
 	spin_unlock(&nn->blocked_locks_lock);
 
 	while (!list_empty(&reaplist)) {
-		nbl = list_first_entry(&nn->blocked_locks_lru,
+		nbl = list_first_entry(&reaplist,
 					struct nfsd4_blocked_lock, nbl_lru);
 		list_del_init(&nbl->nbl_lru);
 		posix_unblock_lock(&nbl->nbl_lock);

Re: [Bug 197817] "Panic: unable to handle kernel page request" in posix_unblock_lock() called from nfs4_laundromat()

[Jeff Layton]

On Thu, 2017-11-09 at 11:07 -0500, J. Bruce Fields wrote:
> On Thu, Nov 09, 2017 at 10:08:28AM +0900, Naofumi Honda wrote:
> > Dear Developers:
> > 
> > > https://bugzilla.kernel.org/show_bug.cgi?id=197817
> > > 
> > > --- Comment #1 from bfields@fieldses.org ---
> > > Yes, I think you're right.
> > > 
> > > Would it be possible for you to submit a patch to fix that typo in those two
> > > places?  (Just mail it to me at bfields@fieldses.org, cc: to
> > > linux-nfs@vger.kernel.org).
> > > 
> > 
> > OK,  I have attached the patch.
> 
> Thanks for the investigation and the fix!
> 
> For future reference, we prefer patches to be inline with the email
> message (not attached), and prefer them in "unified" format.
> 
> But for a one-off patch I can fix it up myself; applied as follows.
> 
> --b.
> 
> commit c26806a20fa3
> Author: Naofumi Honda <honda@math.sci.hokudai.ac.jp>
> Date:   Thu Nov 9 10:57:16 2017 -0500
> 
>     nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
>     
>     From kernel 4.9, my two nfsv4 servers sometimes suffer from
>         "panic: unable to handle kernel page request"
>     in posix_unblock_lock() called from nfs4_laundromat().
>     
>     These panics diseappear if we revert the commit "nfsd: add a LRU list
>     for blocked locks".
>     
>     The cause appears to be a typo in nfs4_laundromat(), which is also
>     present in nfs4_state_shutdown_net().
>     
>     Cc: stable@vger.kernel.org
>     Fixes: 7919d0a27f1e "nfsd: add a LRU list for blocked locks"
>     Cc: jlayton@redhat.com
>     Signed-off-by: J. Bruce Fields <bfields@redhat.com>
> 
> diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
> index 923243369bbc..b99830ab63aa 100644
> --- a/fs/nfsd/nfs4state.c
> +++ b/fs/nfsd/nfs4state.c
> @@ -4791,7 +4791,7 @@ nfs4_laundromat(struct nfsd_net *nn)
>  	spin_unlock(&nn->blocked_locks_lock);
>  
>  	while (!list_empty(&reaplist)) {
> -		nbl = list_first_entry(&nn->blocked_locks_lru,
> +		nbl = list_first_entry(&reaplist,
>  					struct nfsd4_blocked_lock, nbl_lru);
>  		list_del_init(&nbl->nbl_lru);
>  		posix_unblock_lock(&nbl->nbl_lock);
> @@ -7260,7 +7260,7 @@ nfs4_state_shutdown_net(struct net *net)
>  	spin_unlock(&nn->blocked_locks_lock);
>  
>  	while (!list_empty(&reaplist)) {
> -		nbl = list_first_entry(&nn->blocked_locks_lru,
> +		nbl = list_first_entry(&reaplist,
>  					struct nfsd4_blocked_lock, nbl_lru);
>  		list_del_init(&nbl->nbl_lru);
>  		posix_unblock_lock(&nbl->nbl_lock);

<facepalm>

Well spotted! I wonder if this might be the cause of some crashes we've
seen as well?

Reviewed-by: Jeff Layton <jlayton@redhat.com>