nfsd: Reset the boot verifier on all write I/O errors

If multiple clients are writing to the same file, then due to the fact
we share a single file descriptor between all NFSv3 clients writing
to the file, we have a situation where clients can miss the fact that
their file data was not persisted. While this should be rare, it
could cause silent data loss in situations where multiple clients
are using NLM locking or O_DIRECT to write to the same file.
Unfortunately, the stateless nature of NFSv3 and the fact that we
can only identify clients by their IP address means that we cannot
trivially cache errors; we would not know when it is safe to
release them from the cache.

So the solution is to declare a reboot. We understand that this
should be a rare occurrence, since disks are usually stable. The
most frequent occurrence is likely to be ENOSPC, at which point
all writes to the given filesystem are likely to fail anyway.

So the expectation is that clients will be forced to retry their
writes until they hit the fatal error.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

1 files changed, 15 insertions, 4 deletions

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 84e87772c2b8..0867d5319fdb 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -958,8 +958,12 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
         nfsdstats.io_write += *cnt;
         fsnotify_modify(file);
 
-        if (stable && use_wgather)
+        if (stable && use_wgather) {
                 host_err = wait_for_concurrent_writes(file);
+                if (host_err < 0)
+                        nfsd_reset_boot_verifier(net_generic(SVC_NET(rqstp),
+                                                 nfsd_net_id));
+        }
 
 out_nfserr:
         if (host_err >= 0) {
@@ -1063,10 +1067,17 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (EX_ISSYNC(fhp->fh_export)) {
                 int err2 = vfs_fsync_range(nf->nf_file, offset, end, 0);
 
-                if (err2 != -EINVAL)
-                        err = nfserrno(err2);
-                else
+                switch (err2) {
+                case 0:
+                        break;
+                case -EINVAL:
                         err = nfserr_notsupp;
+                        break;
+                default:
+                        err = nfserrno(err2);
+                        nfsd_reset_boot_verifier(net_generic(nf->nf_net,
+                                                 nfsd_net_id));
+                }
         }
 
         nfsd_file_put(nf);