All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Jeff Layton <jlayton@kernel.org>,
	Chuck Lever <chuck.lever@oracle.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 4/7] nfsd: handle NFS4ERR_BADSLOT on CB_SEQUENCE better
Date: Sat,  5 Sep 2026 17:43:29 -0400	[thread overview]
Message-ID: <20260905214332.701369-4-sashal@kernel.org> (raw)
In-Reply-To: <20260905214332.701369-1-sashal@kernel.org>

From: Jeff Layton <jlayton@kernel.org>

[ Upstream commit 999595a651a87f4285c53710b5f600d6a141f526 ]

Currently it just restarts the call, without getting a new slot.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: 01c5d5f58a5d ("nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4callback.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index d0e5f46f0f7cd..c918fd3452f31 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -1202,6 +1202,13 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback
 		rpc_delay(task, 2 * HZ);
 		return false;
 	case -NFS4ERR_BADSLOT:
+		/*
+		 * BADSLOT means that the client and server are out of sync
+		 * as to the backchannel parameters. Mark the backchannel faulty
+		 * and restart the RPC, but leak the slot so no one uses it.
+		 */
+		nfsd4_mark_cb_fault(cb->cb_clp);
+		cb->cb_held_slot = -1;
 		goto retry_nowait;
 	case -NFS4ERR_SEQ_MISORDERED:
 		if (session->se_cb_seq_nr != 1) {
-- 
2.53.0


  parent reply	other threads:[~2026-09-05 21:43 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03 13:07 FAILED: patch "[PATCH] nfsd: RCU-protect cl_cb_session to fix use-after-free on" failed to apply to 6.1-stable tree gregkh
2026-09-05 21:43 ` [PATCH 6.1.y 1/7] nfsd: prepare nfsd4_cb_sequence_done() for error handling rework Sasha Levin
2026-09-05 21:43   ` [PATCH 6.1.y 2/7] nfsd: lift NFSv4.0 handling out of nfsd4_cb_sequence_done() Sasha Levin
2026-09-05 21:43   ` [PATCH 6.1.y 3/7] nfsd: only check RPC_SIGNALLED() when restarting rpc_task Sasha Levin
2026-09-05 21:43   ` Sasha Levin [this message]
2026-09-05 21:43   ` [PATCH 6.1.y 5/7] nfsd: prevent callback tasks running concurrently Sasha Levin
2026-09-05 21:43   ` [PATCH 6.1.y 6/7] nfsd: move cb_need_restart flag into cb_flags Sasha Levin
2026-09-05 21:43   ` [PATCH 6.1.y 7/7] nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260905214332.701369-4-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=chuck.lever@oracle.com \
    --cc=jlayton@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.