Merge tag 'nfsd-4.4' of git://linux-nfs.org/~bfields/linux

Pull nfsd updates from Bruce Fields:
 "Apologies for coming a little late in the merge window.  Fortunately
  this is another fairly quiet one:

  Mainly smaller bugfixes and cleanup.  We're still finding some bugs
  from the breakup of the big NFSv4 state lock in 3.17 -- thanks
  especially to Andrew Elble and Jeff Layton for tracking down some of
  the remaining races"

* tag 'nfsd-4.4' of git://linux-nfs.org/~bfields/linux:
  svcrpc: document lack of some memory barriers
  nfsd: fix race with open / open upgrade stateids
  nfsd: eliminate sending duplicate and repeated delegations
  nfsd: remove recurring workqueue job to clean DRC
  SUNRPC: drop stale comment in svc_setup_socket()
  nfsd: ensure that seqid morphing operations are atomic wrt to copies
  nfsd: serialize layout stateid morphing operations
  nfsd: improve client_has_state to check for unused openowners
  nfsd: fix clid_inuse on mount with security change
  sunrpc/cache: make cache flushing more reliable.
  nfsd: move include of state.h from trace.c to trace.h
  sunrpc: avoid warning in gss_key_timeout
  lockd: get rid of reference-counted NSM RPC clients
  SUNRPC: Use MSG_SENDPAGE_NOTLAST when calling sendpage()
  lockd: create NSM handles per net namespace
  nfsd: switch unsigned char flags in svc_fh to bools
  nfsd: move svc_fh->fh_maxsize to just after fh_handle
  nfsd: drop null test before destroy functions
  nfsd: serialize state seqid morphing operations

3 files changed, 78 insertions, 28 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dace13d7638e..799e65b944b9 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1411,17 +1411,16 @@ gss_key_timeout(struct rpc_cred *rc)
 {
         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
         struct gss_cl_ctx *ctx;
-        unsigned long now = jiffies;
-        unsigned long expire;
+        unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
+        int ret = 0;
 
         rcu_read_lock();
         ctx = rcu_dereference(gss_cred->gc_ctx);
-        if (ctx)
-                expire = ctx->gc_expiry - (gss_key_expire_timeo * HZ);
+        if (!ctx || time_after(timeout, ctx->gc_expiry))
+                ret = -EACCES;
         rcu_read_unlock();
-        if (!ctx || time_after(now, expire))
-                return -EACCES;
-        return 0;
+
+        return ret;
 }
 
 static int
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 4a2340a54401..5e4f815c2b34 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -41,13 +41,16 @@
 static bool cache_defer_req(struct cache_req *req, struct cache_head *item);
 static void cache_revisit_request(struct cache_head *item);
 
-static void cache_init(struct cache_head *h)
+static void cache_init(struct cache_head *h, struct cache_detail *detail)
 {
         time_t now = seconds_since_boot();
         INIT_HLIST_NODE(&h->cache_list);
         h->flags = 0;
         kref_init(&h->ref);
         h->expiry_time = now + CACHE_NEW_EXPIRY;
+        if (now <= detail->flush_time)
+                /* ensure it isn't already expired */
+                now = detail->flush_time + 1;
         h->last_refresh = now;
 }
 
@@ -81,7 +84,7 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
          * we might get lose if we need to
          * cache_put it soon.
          */
-        cache_init(new);
+        cache_init(new, detail);
         detail->init(new, key);
 
         write_lock(&detail->hash_lock);
@@ -116,10 +119,15 @@ EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
 
 static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch);
 
-static void cache_fresh_locked(struct cache_head *head, time_t expiry)
+static void cache_fresh_locked(struct cache_head *head, time_t expiry,
+                               struct cache_detail *detail)
 {
+        time_t now = seconds_since_boot();
+        if (now <= detail->flush_time)
+                /* ensure it isn't immediately treated as expired */
+                now = detail->flush_time + 1;
         head->expiry_time = expiry;
-        head->last_refresh = seconds_since_boot();
+        head->last_refresh = now;
         smp_wmb(); /* paired with smp_rmb() in cache_is_valid() */
         set_bit(CACHE_VALID, &head->flags);
 }
@@ -149,7 +157,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                                 set_bit(CACHE_NEGATIVE, &old->flags);
                         else
                                 detail->update(old, new);
-                        cache_fresh_locked(old, new->expiry_time);
+                        cache_fresh_locked(old, new->expiry_time, detail);
                         write_unlock(&detail->hash_lock);
                         cache_fresh_unlocked(old, detail);
                         return old;
@@ -162,7 +170,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                 cache_put(old, detail);
                 return NULL;
         }
-        cache_init(tmp);
+        cache_init(tmp, detail);
         detail->init(tmp, old);
 
         write_lock(&detail->hash_lock);
@@ -173,8 +181,8 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
         hlist_add_head(&tmp->cache_list, &detail->hash_table[hash]);
         detail->entries++;
         cache_get(tmp);
-        cache_fresh_locked(tmp, new->expiry_time);
-        cache_fresh_locked(old, 0);
+        cache_fresh_locked(tmp, new->expiry_time, detail);
+        cache_fresh_locked(old, 0, detail);
         write_unlock(&detail->hash_lock);
         cache_fresh_unlocked(tmp, detail);
         cache_fresh_unlocked(old, detail);
@@ -219,7 +227,8 @@ static int try_to_negate_entry(struct cache_detail *detail, struct cache_head *h
         rv = cache_is_valid(h);
         if (rv == -EAGAIN) {
                 set_bit(CACHE_NEGATIVE, &h->flags);
-                cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY);
+                cache_fresh_locked(h, seconds_since_boot()+CACHE_NEW_EXPIRY,
+                                   detail);
                 rv = -ENOENT;
         }
         write_unlock(&detail->hash_lock);
@@ -487,10 +496,13 @@ EXPORT_SYMBOL_GPL(cache_flush);
 
 void cache_purge(struct cache_detail *detail)
 {
-        detail->flush_time = LONG_MAX;
+        time_t now = seconds_since_boot();
+        if (detail->flush_time >= now)
+                now = detail->flush_time + 1;
+        /* 'now' is the maximum value any 'last_refresh' can have */
+        detail->flush_time = now;
         detail->nextcheck = seconds_since_boot();
         cache_flush();
-        detail->flush_time = 1;
 }
 EXPORT_SYMBOL_GPL(cache_purge);
 
@@ -1436,6 +1448,7 @@ static ssize_t write_flush(struct file *file, const char __user *buf,
 {
         char tbuf[20];
         char *bp, *ep;
+        time_t then, now;
 
         if (*ppos || count > sizeof(tbuf)-1)
                 return -EINVAL;
@@ -1447,8 +1460,22 @@ static ssize_t write_flush(struct file *file, const char __user *buf,
                 return -EINVAL;
 
         bp = tbuf;
-        cd->flush_time = get_expiry(&bp);
-        cd->nextcheck = seconds_since_boot();
+        then = get_expiry(&bp);
+        now = seconds_since_boot();
+        cd->nextcheck = now;
+        /* Can only set flush_time to 1 second beyond "now", or
+         * possibly 1 second beyond flushtime.  This is because
+         * flush_time never goes backwards so it mustn't get too far
+         * ahead of time.
+         */
+        if (then >= now) {
+                /* Want to flush everything, so behave like cache_purge() */
+                if (cd->flush_time >= now)
+                        now = cd->flush_time + 1;
+                then = now;
+        }
+
+        cd->flush_time = then;
         cache_flush();
 
         *ppos += count;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0c8120229a03..1413cdcc131c 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -181,7 +181,7 @@ int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
         struct page     **ppage = xdr->pages;
         size_t          base = xdr->page_base;
         unsigned int    pglen = xdr->page_len;
-        unsigned int    flags = MSG_MORE;
+        unsigned int    flags = MSG_MORE | MSG_SENDPAGE_NOTLAST;
         int             slen;
         int             len = 0;
 
@@ -399,6 +399,31 @@ static int svc_sock_secure_port(struct svc_rqst *rqstp)
         return svc_port_is_privileged(svc_addr(rqstp));
 }
 
+static bool sunrpc_waitqueue_active(wait_queue_head_t *wq)
+{
+        if (!wq)
+                return false;
+        /*
+         * There should normally be a memory * barrier here--see
+         * wq_has_sleeper().
+         *
+         * It appears that isn't currently necessary, though, basically
+         * because callers all appear to have sufficient memory barriers
+         * between the time the relevant change is made and the
+         * time they call these callbacks.
+         *
+         * The nfsd code itself doesn't actually explicitly wait on
+         * these waitqueues, but it may wait on them for example in
+         * sendpage() or sendmsg() calls.  (And those may be the only
+         * places, since it it uses nonblocking reads.)
+         *
+         * Maybe we should add the memory barriers anyway, but these are
+         * hot paths so we'd need to be convinced there's no sigificant
+         * penalty.
+         */
+        return waitqueue_active(wq);
+}
+
 /*
  * INET callback when data has been received on the socket.
  */
@@ -414,7 +439,7 @@ static void svc_udp_data_ready(struct sock *sk)
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (wq && waitqueue_active(wq))
+        if (sunrpc_waitqueue_active(wq))
                 wake_up_interruptible(wq);
 }
 
@@ -432,7 +457,7 @@ static void svc_write_space(struct sock *sk)
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
 
-        if (wq && waitqueue_active(wq)) {
+        if (sunrpc_waitqueue_active(wq)) {
                 dprintk("RPC svc_write_space: someone sleeping on %p\n",
                        svsk);
                 wake_up_interruptible(wq);
@@ -787,7 +812,7 @@ static void svc_tcp_listen_data_ready(struct sock *sk)
         }
 
         wq = sk_sleep(sk);
-        if (wq && waitqueue_active(wq))
+        if (sunrpc_waitqueue_active(wq))
                 wake_up_interruptible_all(wq);
 }
 
@@ -808,7 +833,7 @@ static void svc_tcp_state_change(struct sock *sk)
                 set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (wq && waitqueue_active(wq))
+        if (sunrpc_waitqueue_active(wq))
                 wake_up_interruptible_all(wq);
 }
 
@@ -823,7 +848,7 @@ static void svc_tcp_data_ready(struct sock *sk)
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (wq && waitqueue_active(wq))
+        if (sunrpc_waitqueue_active(wq))
                 wake_up_interruptible(wq);
 }
 
@@ -1367,7 +1392,6 @@ EXPORT_SYMBOL_GPL(svc_sock_update_bufs);
 
 /*
  * Initialize socket for RPC use and create svc_sock struct
- * XXX: May want to setsockopt SO_SNDBUF and SO_RCVBUF.
  */
 static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
                                                 struct socket *sock,
@@ -1594,7 +1618,7 @@ static void svc_sock_detach(struct svc_xprt *xprt)
         sk->sk_write_space = svsk->sk_owspace;
 
         wq = sk_sleep(sk);
-        if (wq && waitqueue_active(wq))
+        if (sunrpc_waitqueue_active(wq))
                 wake_up_interruptible(wq);
 }