[PATCH v2 2/3] NFS: don't run the release of a WRITE or COMMIT in the submitter

[Mike Snitzer <snitzer@kernel.org>]

nfs_initiate_pgio() and nfs_initiate_commit() start an asynchronous RPC
task and then drop their reference to it with rpc_put_task(). If the
task has already completed, that reference is the last one and
rpc_put_task() runs the rpc_release() callback in the submitter rather
than on nfsiod, where task_setup_data.workqueue asks for it to run.

The release of a WRITE or COMMIT releases write requests and, with
them, what may be the last reference to an open context. The submitter
is usually the flusher, which holds sb->s_umount and has set I_SYNC on
the inode, so it can release neither the superblock nor the inode:

  wb_workfn
    wb_writeback
      writeback_sb_inodes
        __writeback_single_inode
          nfs_write_inode
            __nfs_commit_inode
              nfs_generic_commit_list
                nfs_commit_list
                  nfs_initiate_commit
                    rpc_put_task
                      rpc_free_task
                        nfs_commit_release
                          nfs_commitdata_release
                            put_nfs_open_context
                              nfs_sb_deactive
                                deactivate_super   <- blocks on s_umount

This is the deadlock that was reported in 2014, see the link below.

Before commit bf294b41cefc ("SUNRPC: Close a race in
__rpc_wait_for_completion_task()") the final rpc_put_task() always
handed the release to the workqueue of the task. That commit made
rpc_put_task() run the release in the caller, and added
rpc_put_task_async() for callers that must not. Use it.

nfs_initiate_pgio() also starts READs, whose release now always runs
on nfsiod as well.

Nothing depends on the release of a COMMIT having run by the time
nfs_initiate_commit() returns: no caller has passed it FLUSH_SYNC since
commit 64a93dbf25d3 ("NFS: Fix deadlocks in nfs_scan_commit_list()").
Before that commit nfs_write_inode() did, from the flusher, and the
wait then made the reference of the submitter the last one every time.

Link: https://lore.kernel.org/linux-nfs/20140407135001.56ef9f36@notabene.brown/
Fixes: bf294b41cefc ("SUNRPC: Close a race in __rpc_wait_for_completion_task()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
---
 fs/nfs/pagelist.c | 3 ++-
 fs/nfs/write.c    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 71f0ce2bc4ea..e87ad5651f4d 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -816,7 +816,8 @@ int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr,
 	task = rpc_run_task(&task_setup_data);
 	if (IS_ERR(task))
 		return PTR_ERR(task);
-	rpc_put_task(task);
+	/* The caller may be writeback: don't run rpc_release() here */
+	rpc_put_task_async(task);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nfs_initiate_pgio);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index f38bbebffe4d..766481c5870e 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1677,7 +1677,8 @@ int nfs_initiate_commit(struct rpc_clnt *clnt, struct nfs_commit_data *data,
 		return PTR_ERR(task);
 	if (how & FLUSH_SYNC)
 		rpc_wait_for_completion_task(task);
-	rpc_put_task(task);
+	/* The caller may be writeback: don't run rpc_release() here */
+	rpc_put_task_async(task);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nfs_initiate_commit);
-- 
2.52.0