From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 214A619D084; Mon, 23 Jun 2025 21:43:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750714985; cv=none; b=Iqo1z8FAqVWCNrPcTUEnXQlIzhmY5AsLEESHhfTM+5UdM9WPtPhxIg/i2KT52ZrMJu/jv77jDF+pN3qidCLl95rM1GLNa6csZkQflC2dhmOKyVCfTiOG0xFd/17sTkrobQ4bzpCPJqyeg19VgSSTcafeoEuvkDiIsmgxso3pP7c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750714985; c=relaxed/simple; bh=6xk8RtvZ789zWBpljEWKA3tiDjnYS+pR0y3FozcTBq8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TQruPO6Fk3d+cdrWeMXu6141eCjgERKI94d9QYpIt6+nUvDBXqeWcxJmjYxl6TCIrhoSj89AyQuSvs6Wir2YLVSNUKQbmT7MvfeGGWu5EHunD9Hl30qGcOrtesyOH0jJo6BODsi2QrgGZiemgdwiVFTQpAPgn0ELmpoi6XQOA7Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b9pv0SqL; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="b9pv0SqL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE526C4CEEA; Mon, 23 Jun 2025 21:43:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1750714985; bh=6xk8RtvZ789zWBpljEWKA3tiDjnYS+pR0y3FozcTBq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b9pv0SqLuuWkOU/nhDRV6Vpijq8XwNEQi7N1U78fnyjSjq6oa+oBec3ol11bs/Wxb 29BgOu7jxsyhGHUWxydj0vkStK6vTi9FHUR8C8tgWp4hnra9GIdMq8HLDdCseR9Er+ hsxPV9aLjOws9phW145t2huR5lhVnSXz9J9LlQq0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Long Li , Chuck Lever , Sasha Levin Subject: [PATCH 5.10 236/355] sunrpc: fix race in cache cleanup causing stale nextcheck time Date: Mon, 23 Jun 2025 15:07:17 +0200 Message-ID: <20250623130633.846450386@linuxfoundation.org> X-Mailer: git-send-email 2.50.0 In-Reply-To: <20250623130626.716971725@linuxfoundation.org> References: <20250623130626.716971725@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Long Li [ Upstream commit 2298abcbe11e9b553d03c0f1d084da786f7eff88 ] When cache cleanup runs concurrently with cache entry removal, a race condition can occur that leads to incorrect nextcheck times. This can delay cache cleanup for the cache_detail by up to 1800 seconds: 1. cache_clean() sets nextcheck to current time plus 1800 seconds 2. While scanning a non-empty bucket, concurrent cache entry removal can empty that bucket 3. cache_clean() finds no cache entries in the now-empty bucket to update the nextcheck time 4. This maybe delays the next scan of the cache_detail by up to 1800 seconds even when it should be scanned earlier based on remaining entries Fix this by moving the hash_lock acquisition earlier in cache_clean(). This ensures bucket emptiness checks and nextcheck updates happen atomically, preventing the race between cleanup and entry removal. Signed-off-by: Long Li Signed-off-by: Chuck Lever Signed-off-by: Sasha Levin --- net/sunrpc/cache.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 0a91945db88fe..81a780c1226c9 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -451,24 +451,21 @@ static int cache_clean(void) } } + spin_lock(¤t_detail->hash_lock); + /* find a non-empty bucket in the table */ - while (current_detail && - current_index < current_detail->hash_size && + while (current_index < current_detail->hash_size && hlist_empty(¤t_detail->hash_table[current_index])) current_index++; /* find a cleanable entry in the bucket and clean it, or set to next bucket */ - - if (current_detail && current_index < current_detail->hash_size) { + if (current_index < current_detail->hash_size) { struct cache_head *ch = NULL; struct cache_detail *d; struct hlist_head *head; struct hlist_node *tmp; - spin_lock(¤t_detail->hash_lock); - /* Ok, now to clean this strand */ - head = ¤t_detail->hash_table[current_index]; hlist_for_each_entry_safe(ch, tmp, head, cache_list) { if (current_detail->nextcheck > ch->expiry_time) @@ -489,8 +486,10 @@ static int cache_clean(void) spin_unlock(&cache_list_lock); if (ch) sunrpc_end_cache_remove_entry(ch, d); - } else + } else { + spin_unlock(¤t_detail->hash_lock); spin_unlock(&cache_list_lock); + } return rv; } -- 2.39.5