From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 809172472AF; Mon, 23 Jun 2025 13:37:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750685854; cv=none; b=oH9NmBcefLKV7iOF+eshS6/cxqj+kJnBlAKcr7/AduwsTU8Kp4TYQsJIzLpPys2h3oJfchFCCvx4UPRtsxek3vFQ3pO0Attr6Xrv0ROVUZN+sXZB07wm9q15thEnKRjO7ojqFqZIAUnZ3rWPeCjkKxv+NhNIMkUHkkTMGurWRAM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750685854; c=relaxed/simple; bh=T25MLdOoG4tY67RoXDPxWqwqJjqWjGAIwpv2h/B2IrQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fhyVaeN7y52pahbijOKam5Vcsw2aP2jGpjlGps87Njr24d1pFS3Kr553FL6qO+2jmnvPYvxnbshxcKkJ2aipzfDjJZUL9J/iEhO/a+QYQyzQavT3KKKLkS4C67flkGFScGx1reuvqVvH12cOBm20f4K2LeRnTnwBxOIgCZzH+kg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KcGhI8aZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KcGhI8aZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 167E9C4CEF0; Mon, 23 Jun 2025 13:37:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1750685854; bh=T25MLdOoG4tY67RoXDPxWqwqJjqWjGAIwpv2h/B2IrQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KcGhI8aZ9YTk+M+M0+n1x8keTSm2ePwsszppjRhQhvKSn2lOXgpRAp75nnpLUuiQN f1mc9ZerJnDIkCKPPP4idU5A2jKNXGTldKmCedNAOu/pdUXvnAymvu3kXk7JjU02uX DvHH7rIbFOJbLcem/yVO4jJ8U15XFOPjsCGWvXgs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Long Li , Chuck Lever , Sasha Levin Subject: [PATCH 6.15 288/592] sunrpc: fix race in cache cleanup causing stale nextcheck time Date: Mon, 23 Jun 2025 15:04:06 +0200 Message-ID: <20250623130707.211200504@linuxfoundation.org> X-Mailer: git-send-email 2.50.0 In-Reply-To: <20250623130700.210182694@linuxfoundation.org> References: <20250623130700.210182694@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Long Li [ Upstream commit 2298abcbe11e9b553d03c0f1d084da786f7eff88 ] When cache cleanup runs concurrently with cache entry removal, a race condition can occur that leads to incorrect nextcheck times. This can delay cache cleanup for the cache_detail by up to 1800 seconds: 1. cache_clean() sets nextcheck to current time plus 1800 seconds 2. While scanning a non-empty bucket, concurrent cache entry removal can empty that bucket 3. cache_clean() finds no cache entries in the now-empty bucket to update the nextcheck time 4. This maybe delays the next scan of the cache_detail by up to 1800 seconds even when it should be scanned earlier based on remaining entries Fix this by moving the hash_lock acquisition earlier in cache_clean(). This ensures bucket emptiness checks and nextcheck updates happen atomically, preventing the race between cleanup and entry removal. Signed-off-by: Long Li Signed-off-by: Chuck Lever Signed-off-by: Sasha Levin --- net/sunrpc/cache.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index bbaa77d7bbc81..131090f31e6a8 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -464,24 +464,21 @@ static int cache_clean(void) } } + spin_lock(¤t_detail->hash_lock); + /* find a non-empty bucket in the table */ - while (current_detail && - current_index < current_detail->hash_size && + while (current_index < current_detail->hash_size && hlist_empty(¤t_detail->hash_table[current_index])) current_index++; /* find a cleanable entry in the bucket and clean it, or set to next bucket */ - - if (current_detail && current_index < current_detail->hash_size) { + if (current_index < current_detail->hash_size) { struct cache_head *ch = NULL; struct cache_detail *d; struct hlist_head *head; struct hlist_node *tmp; - spin_lock(¤t_detail->hash_lock); - /* Ok, now to clean this strand */ - head = ¤t_detail->hash_table[current_index]; hlist_for_each_entry_safe(ch, tmp, head, cache_list) { if (current_detail->nextcheck > ch->expiry_time) @@ -502,8 +499,10 @@ static int cache_clean(void) spin_unlock(&cache_list_lock); if (ch) sunrpc_end_cache_remove_entry(ch, d); - } else + } else { + spin_unlock(¤t_detail->hash_lock); spin_unlock(&cache_list_lock); + } return rv; } -- 2.39.5