linux-kernel - [bug report] NFSv4.0: deadlock of state manager and lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d695379f-3dbb-4e5a-a857-e4cd31df6843@huawei.com>
Date: Tue, 26 Nov 2024 21:22:31 +0800
From: Li Lingfeng <lilingfeng3@...wei.com>
To: <trondmy@...nel.org>, <anna@...nel.org>,
	<trond.myklebust@...merspace.com>, Jeff Layton <jlayton@...nel.org>
CC: <linux-nfs@...r.kernel.org>, <linux-kernel@...r.kernel.org>, "yukuai (C)"
	<yukuai3@...wei.com>, Hou Tao <houtao1@...wei.com>, "zhangyi (F)"
	<yi.zhang@...wei.com>, yangerkun <yangerkun@...wei.com>,
	<chengzhihao1@...wei.com>
Subject: [bug report] NFSv4.0: deadlock of state manager and lock

Hi, we have found a deadlock recently due to that only the first task in
the list of nfs_seqid_counter can be executed.

T1 -- NFSPROC4_CLNT_LOCKU
nfs4_locku_prepare
  nfs_wait_on_sequence
   list_add_tail // add to sequence->list
   // This is the first task.

nfs4_locku_done
  nfs4_async_handle_exception
   rpc_sleep_on
   // Sleep on clp->cl_rpcwaitq,
   // and wait for being woken up by T2
   <-------- can not get here -------->
   nfs_release_seqid
    rpc_wake_up_queued_task // wake up T2

T2 -- state manager
nfs4_state_manager
  nfs4_do_reclaim
   nfs4_reclaim_open_state
    __nfs4_reclaim_open_state
     nfs40_open_expired
      nfs4_open_expired
       nfs4_do_open_expired
        _nfs4_open_expired
         nfs4_open_recover
          nfs4_open_recover_helper
           _nfs4_recover_proc_open
            nfs4_run_open_task
            ...
            nfs4_open_prepare
             nfs_wait_on_sequence
              list_add_tail // add to sequence->list
              // This is the second task.
              rpc_sleep_on
              // Sleep on sequence->wait,
              // and wait for being woken up by T1
  <-------- can not get here -------->
  nfs4_clear_state_manager_bit
   rpc_wake_up // wake up T1

T1 occupies the first position of sequence->list and waits to be woken up
by T2.
T2 has to be woken up by T1 who occupies the first position.

We haven't come up with a suitable solution yet. Any suggestions will be
appreciated.

Thanks.