NFSv4.1: Again fix a race where CB_NOTIFY_LOCK fails to wake a waiter

BugLink: https://bugs.launchpad.net/bugs/1838700
commit 52b042ab9948cc367b61f9ca9c18603aa7813c3a upstream.

Commit b7dbcc0e433f "NFSv4.1: Fix a race where CB_NOTIFY_LOCK fails to wake a waiter"
found this bug. However it didn't fix it.

This commit replaces schedule_timeout() with wait_woken() and
default_wake_function() with woken_wake_function() in function
nfs4_retry_setlk() and nfs4_wake_lock_waiter(). wait_woken() uses
memory barriers in its implementation to avoid potential race condition
when putting a process into sleeping state and then waking it up.

Fixes: a1d617d8f134 ("nfs: allow blocking locks to be awoken by lock callbacks")
Cc: stable@vger.kernel.org #4.9+
Signed-off-by: Yihao Wu <wuyihao@linux.alibaba.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index b15e5d79b053986e65c6167e71dc86ce31362975..36d03211f05fca97a8d757144a8b265bce3fbaf7 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6614,7 +6614,6 @@ struct nfs4_lock_waiter {
        struct task_struct      *task;
        struct inode            *inode;
        struct nfs_lowner       *owner;
-       bool                    notified;
 };
 
 static int
@@ -6636,11 +6635,11 @@ nfs4_wake_lock_waiter(wait_queue_entry_t *wait, unsigned int mode, int flags, vo
        if (nfs_compare_fh(NFS_FH(waiter->inode), &cbnl->cbnl_fh))
                return 0;
 
-       waiter->notified = true;
-
        /* override "private" so we can use default_wake_function */
        wait->private = waiter->task;
-       ret = autoremove_wake_function(wait, mode, flags, key);
+       ret = woken_wake_function(wait, mode, flags, key);
+       if (ret)
+               list_del_init(&wait->entry);
        wait->private = waiter;
        return ret;
 }
@@ -6649,7 +6648,6 @@ static int
 nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
 {
        int status = -ERESTARTSYS;
-       unsigned long flags;
        struct nfs4_lock_state *lsp = request->fl_u.nfs4_fl.owner;
        struct nfs_server *server = NFS_SERVER(state->inode);
        struct nfs_client *clp = server->nfs_client;
@@ -6659,8 +6657,7 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
                                    .s_dev = server->s_dev };
        struct nfs4_lock_waiter waiter = { .task  = current,
                                           .inode = state->inode,
-                                          .owner = &owner,
-                                          .notified = false };
+                                          .owner = &owner};
        wait_queue_entry_t wait;
 
        /* Don't bother with waitqueue if we don't expect a callback */
@@ -6678,15 +6675,9 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
                        break;
 
                status = -ERESTARTSYS;
-               spin_lock_irqsave(&q->lock, flags);
-               if (waiter.notified) {
-                       spin_unlock_irqrestore(&q->lock, flags);
-                       continue;
-               }
-               set_current_state(TASK_INTERRUPTIBLE);
-               spin_unlock_irqrestore(&q->lock, flags);
-
-               freezable_schedule_timeout(NFS4_LOCK_MAXTIMEOUT);
+               freezer_do_not_count();
+               wait_woken(&wait, TASK_INTERRUPTIBLE, NFS4_LOCK_MAXTIMEOUT);
+               freezer_count();
        }
 
        finish_wait(q, &wait);