Re: [PATCH v5 2/7] NFSD: Add NFSD_CMD_UNLOCK_IP netlink command

[Jeff Layton <jlayton@kernel.org>]

On Thu, 2026-03-26 at 13:55 -0400, Chuck Lever wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> The existing write_unlock_ip procfs interface releases NLM file
> locks held by a specific client IP address, but procfs provides
> no structured way to extend that operation to other scopes such as
> revoking NFSv4 state.
> 
> Add NFSD_CMD_UNLOCK_IP as a dedicated netlink command for
> releasing NLM locks by client address. The command accepts a
> binary sockaddr_in or sockaddr_in6 in its address attribute.
> The handler validates the address family and length, then calls
> nlmsvc_unlock_all_by_ip() to release matching NLM locks.  Because
> lockd is a single global instance, that call operates across
> all network namespaces regardless of which namespace the caller
> inhabits.
> 
> A separate netlink command for filesystem-scoped unlock is added in
> a subsequent commit.
> 
> The nfsd_ctl_unlock_ip tracepoint is updated from string-based
> address logging to __sockaddr, which stores the binary sockaddr
> and formats it with %pISpc. This affects both the new netlink path
> and the existing procfs write_unlock_ip path, giving consistent
> structured output in both cases.
> 
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
>  Documentation/netlink/specs/nfsd.yaml | 18 ++++++++++++++++
>  fs/nfsd/netlink.c                     | 12 +++++++++++
>  fs/nfsd/netlink.h                     |  1 +
>  fs/nfsd/nfsctl.c                      | 40 ++++++++++++++++++++++++++++++++++-
>  fs/nfsd/trace.h                       | 13 ++++++------
>  include/uapi/linux/nfsd_netlink.h     |  8 +++++++
>  6 files changed, 85 insertions(+), 7 deletions(-)
> 
> diff --git a/Documentation/netlink/specs/nfsd.yaml b/Documentation/netlink/specs/nfsd.yaml
> index 8ab43c8253b2..9918b9a84d88 100644
> --- a/Documentation/netlink/specs/nfsd.yaml
> +++ b/Documentation/netlink/specs/nfsd.yaml
> @@ -132,6 +132,15 @@ attribute-sets:
>        -
>          name: npools
>          type: u32
> +  -
> +    name: unlock-ip
> +    attributes:
> +      -
> +        name: address
> +        type: binary
> +        doc: struct sockaddr_in or struct sockaddr_in6.
> +        checks:
> +          min-len: 16
>  
>  operations:
>    list:
> @@ -233,3 +242,12 @@ operations:
>            attributes:
>              - mode
>              - npools
> +    -
> +      name: unlock-ip
> +      doc: release NLM locks held by an IP address
> +      attribute-set: unlock-ip
> +      flags: [admin-perm]
> +      do:
> +        request:
> +          attributes:
> +            - address
> diff --git a/fs/nfsd/netlink.c b/fs/nfsd/netlink.c
> index 81c943345d13..6b7221ce6869 100644
> --- a/fs/nfsd/netlink.c
> +++ b/fs/nfsd/netlink.c
> @@ -48,6 +48,11 @@ static const struct nla_policy nfsd_pool_mode_set_nl_policy[NFSD_A_POOL_MODE_MOD
>  	[NFSD_A_POOL_MODE_MODE] = { .type = NLA_NUL_STRING, },
>  };
>  
> +/* NFSD_CMD_UNLOCK_IP - do */
> +static const struct nla_policy nfsd_unlock_ip_nl_policy[NFSD_A_UNLOCK_IP_ADDRESS + 1] = {
> +	[NFSD_A_UNLOCK_IP_ADDRESS] = NLA_POLICY_MIN_LEN(16),
> +};
> +
>  /* Ops table for nfsd */
>  static const struct genl_split_ops nfsd_nl_ops[] = {
>  	{
> @@ -103,6 +108,13 @@ static const struct genl_split_ops nfsd_nl_ops[] = {
>  		.doit	= nfsd_nl_pool_mode_get_doit,
>  		.flags	= GENL_CMD_CAP_DO,
>  	},
> +	{
> +		.cmd		= NFSD_CMD_UNLOCK_IP,
> +		.doit		= nfsd_nl_unlock_ip_doit,
> +		.policy		= nfsd_unlock_ip_nl_policy,
> +		.maxattr	= NFSD_A_UNLOCK_IP_ADDRESS,
> +		.flags		= GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> +	},
>  };
>  
>  struct genl_family nfsd_nl_family __ro_after_init = {
> diff --git a/fs/nfsd/netlink.h b/fs/nfsd/netlink.h
> index 478117ff6b8c..3c2d5996612f 100644
> --- a/fs/nfsd/netlink.h
> +++ b/fs/nfsd/netlink.h
> @@ -26,6 +26,7 @@ int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info);
>  int nfsd_nl_listener_get_doit(struct sk_buff *skb, struct genl_info *info);
>  int nfsd_nl_pool_mode_set_doit(struct sk_buff *skb, struct genl_info *info);
>  int nfsd_nl_pool_mode_get_doit(struct sk_buff *skb, struct genl_info *info);
> +int nfsd_nl_unlock_ip_doit(struct sk_buff *skb, struct genl_info *info);
>  
>  extern struct genl_family nfsd_nl_family;
>  
> diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
> index 988a79ec4a79..e1e89d52e6de 100644
> --- a/fs/nfsd/nfsctl.c
> +++ b/fs/nfsd/nfsctl.c
> @@ -246,7 +246,7 @@ static ssize_t write_unlock_ip(struct file *file, char *buf, size_t size)
>  	if (rpc_pton(net, fo_path, size, sap, salen) == 0)
>  		return -EINVAL;
>  
> -	trace_nfsd_ctl_unlock_ip(net, buf);
> +	trace_nfsd_ctl_unlock_ip(net, sap, svc_addr_len(sap));
>  	return nlmsvc_unlock_all_by_ip(sap);
>  }
>  
> @@ -2200,6 +2200,44 @@ int nfsd_nl_pool_mode_get_doit(struct sk_buff *skb, struct genl_info *info)
>  	return err;
>  }
>  
> +/**
> + * nfsd_nl_unlock_ip_doit - release NLM locks held by an IP address
> + * @skb: reply buffer
> + * @info: netlink metadata and command arguments
> + *
> + * Return: 0 on success or a negative errno.
> + */
> +int nfsd_nl_unlock_ip_doit(struct sk_buff *skb, struct genl_info *info)
> +{
> +	struct sockaddr *sap;
> +
> +	if (GENL_REQ_ATTR_CHECK(info, NFSD_A_UNLOCK_IP_ADDRESS))
> +		return -EINVAL;
> +	sap = nla_data(info->attrs[NFSD_A_UNLOCK_IP_ADDRESS]);
> +	switch (sap->sa_family) {
> +	case AF_INET:
> +		if (nla_len(info->attrs[NFSD_A_UNLOCK_IP_ADDRESS]) <
> +		    sizeof(struct sockaddr_in))
> +			return -EINVAL;
> +		break;
> +	case AF_INET6:
> +		if (nla_len(info->attrs[NFSD_A_UNLOCK_IP_ADDRESS]) <
> +		    sizeof(struct sockaddr_in6))
> +			return -EINVAL;
> +		break;
> +	default:
> +		return -EAFNOSUPPORT;
> +	}
> +	/*
> +	 * nlmsvc_unlock_all_by_ip() releases matching locks
> +	 * across all network namespaces because lockd operates
> +	 * a single global instance.
> +	 */
> +	trace_nfsd_ctl_unlock_ip(genl_info_net(info), sap,
> +				 svc_addr_len(sap));

All of the tracepoints get passed svc_addr_len(sap) for the length. Any
reason not to just determine the length inside the tracepoint, so you
don't need to calc the length unless it's enabled?

> +	return nlmsvc_unlock_all_by_ip(sap);
> +}
> +
>  /**
>   * nfsd_net_init - Prepare the nfsd_net portion of a new net namespace
>   * @net: a freshly-created network namespace
> diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
> index 5ad38f50836d..976815f6f30f 100644
> --- a/fs/nfsd/trace.h
> +++ b/fs/nfsd/trace.h
> @@ -1985,19 +1985,20 @@ TRACE_EVENT(nfsd_cb_recall_any_done,
>  TRACE_EVENT(nfsd_ctl_unlock_ip,
>  	TP_PROTO(
>  		const struct net *net,
> -		const char *address
> +		const struct sockaddr *addr,
> +		const unsigned int addrlen
>  	),
> -	TP_ARGS(net, address),
> +	TP_ARGS(net, addr, addrlen),
>  	TP_STRUCT__entry(
>  		__field(unsigned int, netns_ino)
> -		__string(address, address)
> +		__sockaddr(addr, addrlen)
>  	),
>  	TP_fast_assign(
>  		__entry->netns_ino = net->ns.inum;
> -		__assign_str(address);
> +		__assign_sockaddr(addr, addr, addrlen);
>  	),
> -	TP_printk("address=%s",
> -		__get_str(address)
> +	TP_printk("addr=%pISpc",
> +		__get_sockaddr(addr)
>  	)
>  );
>  
> diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h
> index 97c7447f4d14..4153e9c69fbf 100644
> --- a/include/uapi/linux/nfsd_netlink.h
> +++ b/include/uapi/linux/nfsd_netlink.h
> @@ -81,6 +81,13 @@ enum {
>  	NFSD_A_POOL_MODE_MAX = (__NFSD_A_POOL_MODE_MAX - 1)
>  };
>  
> +enum {
> +	NFSD_A_UNLOCK_IP_ADDRESS = 1,
> +
> +	__NFSD_A_UNLOCK_IP_MAX,
> +	NFSD_A_UNLOCK_IP_MAX = (__NFSD_A_UNLOCK_IP_MAX - 1)
> +};
> +
>  enum {
>  	NFSD_CMD_RPC_STATUS_GET = 1,
>  	NFSD_CMD_THREADS_SET,
> @@ -91,6 +98,7 @@ enum {
>  	NFSD_CMD_LISTENER_GET,
>  	NFSD_CMD_POOL_MODE_SET,
>  	NFSD_CMD_POOL_MODE_GET,
> +	NFSD_CMD_UNLOCK_IP,
>  
>  	__NFSD_CMD_MAX,
>  	NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1)

-- 
Jeff Layton <jlayton@kernel.org>