[PATCH 4/7] SUNRPC: bound the local rpcbind client timeout to 1s

[Jeff Layton <jlayton@kernel.org>]

The kernel's local rpcbind client runs on the transport defaults: a 10s
major timeout for AF_LOCAL, 60s for the loopback TCP fallback
(xprt_calc_majortimeo() returns to_initval when to_increment is 0).

Those calls are synchronous and run under nfsd_mutex, several per
operation: rpcb_create_local() attempts up to three client creations, and
svc_register() issues one call per program and version. A local rpcbind
that accepts the connection but never replies stalls each of them, and
the accumulated hold is enough to trip the hung-task watchdog on other
NFSD netlink ops (the holder waits killably and evades it):

  INFO: task hung in nfsd_nl_cache_flush_doit

The local rpcbind lives on loopback or an AF_LOCAL socket and answers in
microseconds, so bound its client to one attempt, 1s.

This shortens the stall rather than removing it, and it is not free.
Registration stays synchronous and stays fatal: rpcb_create_local()
failure aborts nfsd_create_serv() via svc_bind(), and svc_register()
failure makes svc_setup_socket() fail, so a rpcbind that is merely slow
to be scheduled can now fail server startup where it previously
succeeded. Making the registration asynchronous is the real fix.

Link: https://syzkaller.appspot.com/bug?extid=c7eae0eb80858a2dba0f
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Assisted-by: LLM
---
 net/sunrpc/rpcb_clnt.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 6aa372188c86..0aa376b82a52 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -221,6 +221,16 @@ static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
 # define SUN_LEN(ptr) (offsetof(struct sockaddr_un, sun_path)		\
 		      + 1 + strlen((ptr)->sun_path + 1))
 
+/*
+ * The kernel's rpcbind client talks only to the local rpcbind, over loopback
+ * or a local AF_LOCAL socket, where a healthy rpcbind answers in microseconds.
+ */
+static const struct rpc_timeout rpcb_local_timeout = {
+	.to_initval	= 1 * HZ,
+	.to_maxval	= 1 * HZ,
+	.to_retries	= 0,
+};
+
 /*
  * Returns zero on success, otherwise a negative errno value
  * is returned.
@@ -238,6 +248,7 @@ static int rpcb_create_af_local(struct net *net,
 		.version	= RPCBVERS_2,
 		.authflavor	= RPC_AUTH_NULL,
 		.cred		= current_cred(),
+		.timeout	= &rpcb_local_timeout,
 		/*
 		 * We turn off the idle timeout to prevent the kernel
 		 * from automatically disconnecting the socket.
@@ -312,6 +323,7 @@ static int rpcb_create_local_net(struct net *net)
 		.version	= RPCBVERS_2,
 		.authflavor	= RPC_AUTH_UNIX,
 		.cred		= current_cred(),
+		.timeout	= &rpcb_local_timeout,
 		.flags		= RPC_CLNT_CREATE_NOPING,
 	};
 	struct rpc_clnt *clnt, *clnt4;

-- 
2.55.0