[PATCH 1/3] NFS: Fix an Oopsable condition in __nfs_pageio_add_request()

[PATCH 1/3] NFS: Fix an Oopsable condition in __nfs_pageio_add_request()

[trondmy]

From: Trond Myklebust <trond.myklebust@hammerspace.com>

Ensure that nfs_pageio_error_cleanup() resets the mirror array contents,
so that the structure reflects the fact that it is now empty.
Also change the test in nfs_pageio_do_add_request() to be more robust by
checking whether or not the list is empty rather than relying on the
value of pg_count.

Fixes: fdbd1a2e4a71 ("nfs: Fix a missed page unlock after pg_doio()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
---
 fs/nfs/pagelist.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 6c20b28d9d7c..76869728c44e 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1094,15 +1094,14 @@ nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,
 	struct nfs_page *prev = NULL;
 	unsigned int size;
 
-	if (mirror->pg_count != 0) {
-		prev = nfs_list_entry(mirror->pg_list.prev);
-	} else {
+	if (list_empty(&mirror->pg_list)) {
 		if (desc->pg_ops->pg_init)
 			desc->pg_ops->pg_init(desc, req);
 		if (desc->pg_error < 0)
 			return 0;
 		mirror->pg_base = req->wb_pgbase;
-	}
+	} else
+		prev = nfs_list_entry(mirror->pg_list.prev);
 
 	if (desc->pg_maxretrans && req->wb_nio > desc->pg_maxretrans) {
 		if (NFS_SERVER(desc->pg_inode)->flags & NFS_MOUNT_SOFTERR)
@@ -1278,6 +1277,9 @@ static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
 		mirror = nfs_pgio_get_mirror(desc, midx);
 		desc->pg_completion_ops->error_cleanup(&mirror->pg_list,
 				desc->pg_error);
+		mirror->pg_count = 0;
+		mirror->pg_base = 0;
+		mirror->pg_recoalesce = 0;
 	}
 }
 
-- 
2.31.1

[PATCH 2/3] NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()

[trondmy]

From: Trond Myklebust <trond.myklebust@hammerspace.com>

The value of mirror->pg_bytes_written should only be updated after a
successful attempt to flush out the requests on the list.

Fixes: a7d42ddb3099 ("nfs: add mirroring support to pgio layer")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
---
 fs/nfs/pagelist.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 76869728c44e..a5d3e2a12ae9 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1126,17 +1126,16 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
 {
 	struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
 
-
 	if (!list_empty(&mirror->pg_list)) {
 		int error = desc->pg_ops->pg_doio(desc);
 		if (error < 0)
 			desc->pg_error = error;
-		else
-			mirror->pg_bytes_written += mirror->pg_count;
 	}
 	if (list_empty(&mirror->pg_list)) {
+		mirror->pg_bytes_written += mirror->pg_count;
 		mirror->pg_count = 0;
 		mirror->pg_base = 0;
+		mirror->pg_recoalesce = 0;
 	}
 }
 
@@ -1226,7 +1225,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
 
 	do {
 		list_splice_init(&mirror->pg_list, &head);
-		mirror->pg_bytes_written -= mirror->pg_count;
 		mirror->pg_count = 0;
 		mirror->pg_base = 0;
 		mirror->pg_recoalesce = 0;
-- 
2.31.1

[PATCH 3/3] NFS: Clean up reset of the mirror accounting variables

[trondmy]

From: Trond Myklebust <trond.myklebust@hammerspace.com>

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
---
 fs/nfs/pagelist.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index a5d3e2a12ae9..855f159fe9da 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -810,6 +810,13 @@ static void nfs_pgio_release(void *calldata)
 	hdr->completion_ops->completion(hdr);
 }
 
+static void nfs_pageio_mirror_reset(struct nfs_pgio_mirror *mirror)
+{
+	mirror->pg_count = 0;
+	mirror->pg_base = 0;
+	mirror->pg_recoalesce = 0;
+}
+
 static void nfs_pageio_mirror_init(struct nfs_pgio_mirror *mirror,
 				   unsigned int bsize)
 {
@@ -1133,9 +1140,7 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
 	}
 	if (list_empty(&mirror->pg_list)) {
 		mirror->pg_bytes_written += mirror->pg_count;
-		mirror->pg_count = 0;
-		mirror->pg_base = 0;
-		mirror->pg_recoalesce = 0;
+		nfs_pageio_mirror_reset(mirror);
 	}
 }
 
@@ -1225,9 +1230,7 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
 
 	do {
 		list_splice_init(&mirror->pg_list, &head);
-		mirror->pg_count = 0;
-		mirror->pg_base = 0;
-		mirror->pg_recoalesce = 0;
+		nfs_pageio_mirror_reset(mirror);
 
 		while (!list_empty(&head)) {
 			struct nfs_page *req;
@@ -1275,9 +1278,7 @@ static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
 		mirror = nfs_pgio_get_mirror(desc, midx);
 		desc->pg_completion_ops->error_cleanup(&mirror->pg_list,
 				desc->pg_error);
-		mirror->pg_count = 0;
-		mirror->pg_base = 0;
-		mirror->pg_recoalesce = 0;
+		nfs_pageio_mirror_reset(mirror);
 	}
 }
 
-- 
2.31.1