afs: Fix hang on rmmod due to outstanding timer

The fileserver probe timer, net->fs_probe_timer, isn't cancelled when
the kafs module is being removed and so the count it holds on
net->servers_outstanding doesn't get dropped..

This causes rmmod to wait forever.  The hung process shows a stack like:

	afs_purge_servers+0x1b5/0x23c [kafs]
	afs_net_exit+0x44/0x6e [kafs]
	ops_exit_list+0x72/0x93
	unregister_pernet_operations+0x14c/0x1ba
	unregister_pernet_subsys+0x1d/0x2a
	afs_exit+0x29/0x6f [kafs]
	__do_sys_delete_module.isra.0+0x1a2/0x24b
	do_syscall_64+0x51/0x95
	entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix this by:

 (1) Attempting to cancel the probe timer and, if successful, drop the
     count that the timer was holding.

 (2) Make the timer function just drop the count and not schedule the
     prober if the afs portion of net namespace is being destroyed.

Also, whilst we're at it, make the following changes:

 (3) Initialise net->servers_outstanding to 1 and decrement it before
     waiting on it so that it doesn't generate wake up events by being
     decremented to 0 until we're cleaning up.

 (4) Switch the atomic_dec() on ->servers_outstanding for ->fs_timer in
     afs_purge_servers() to use the helper function for that.

Fixes: f6cbb368bcb0 ("afs: Actively poll fileservers to maintain NAT or firewall openings")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
index b34f74b0f319adf0b03d618254502ded9b175140..5d9ef517cf8162335c592ee2c57338f344e979de 100644 (file)
--- a/fs/afs/fs_probe.c
+++ b/fs/afs/fs_probe.c
@@ -314,7 +314,7 @@ void afs_fs_probe_timer(struct timer_list *timer)
 {
        struct afs_net *net = container_of(timer, struct afs_net, fs_probe_timer);
 
-       if (!queue_work(afs_wq, &net->fs_prober))
+       if (!net->live || !queue_work(afs_wq, &net->fs_prober))
                afs_dec_servers_outstanding(net);
 }
 
@@ -458,3 +458,12 @@ dont_wait:
                return -ETIME;
        return -EDESTADDRREQ;
 }
+
+/*
+ * Clean up the probing when the namespace is killed off.
+ */
+void afs_fs_probe_cleanup(struct afs_net *net)
+{
+       if (del_timer_sync(&net->fs_probe_timer))
+               afs_dec_servers_outstanding(net);
+}

diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 573a5922c3bb98df2bb86473239a895683e72828..d520535ddb629f4f4db2c26186834834980e60df 100644 (file)
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1065,6 +1065,7 @@ extern int afs_wait_for_fs_probes(struct afs_server_list *, unsigned long);
 extern void afs_probe_fileserver(struct afs_net *, struct afs_server *);
 extern void afs_fs_probe_dispatcher(struct work_struct *);
 extern int afs_wait_for_one_fs_probe(struct afs_server *, bool);
+extern void afs_fs_probe_cleanup(struct afs_net *);
 
 /*
  * inode.c

diff --git a/fs/afs/main.c b/fs/afs/main.c
index 9c79c91e80053daee29ac55c58856fe0365b62bd..31b472f7c734c2eb7169244998d744cfca6b731d 100644 (file)
--- a/fs/afs/main.c
+++ b/fs/afs/main.c
@@ -100,6 +100,7 @@ static int __net_init afs_net_init(struct net *net_ns)
        timer_setup(&net->fs_timer, afs_servers_timer, 0);
        INIT_WORK(&net->fs_prober, afs_fs_probe_dispatcher);
        timer_setup(&net->fs_probe_timer, afs_fs_probe_timer, 0);
+       atomic_set(&net->servers_outstanding, 1);
 
        ret = -ENOMEM;
        sysnames = kzalloc(sizeof(*sysnames), GFP_KERNEL);
@@ -130,6 +131,7 @@ static int __net_init afs_net_init(struct net *net_ns)
 
 error_open_socket:
        net->live = false;
+       afs_fs_probe_cleanup(net);
        afs_cell_purge(net);
        afs_purge_servers(net);
 error_cell_init:
@@ -150,6 +152,7 @@ static void __net_exit afs_net_exit(struct net *net_ns)
        struct afs_net *net = afs_net(net_ns);
 
        net->live = false;
+       afs_fs_probe_cleanup(net);
        afs_cell_purge(net);
        afs_purge_servers(net);
        afs_close_socket(net);

diff --git a/fs/afs/server.c b/fs/afs/server.c
index 039e3488511c0b0b449436f2d82c7c85440e1beb..e82e452e26124e2908892eb12716657f3abb6baf 100644 (file)
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -605,11 +605,12 @@ void afs_purge_servers(struct afs_net *net)
        _enter("");
 
        if (del_timer_sync(&net->fs_timer))
-               atomic_dec(&net->servers_outstanding);
+               afs_dec_servers_outstanding(net);
 
        afs_queue_server_manager(net);
 
        _debug("wait");
+       atomic_dec(&net->servers_outstanding);
        wait_var_event(&net->servers_outstanding,
                       !atomic_read(&net->servers_outstanding));
        _leave("");