mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

SUNRPC: Check svc pool percpu counter allocation

Browse Source 
__svc_create() initializes three per-pool percpu_counter stats and
ignores every return value. On SMP, percpu_counter_init() fails when
__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed
counter with fbc->counters == NULL and its embedded raw_spinlock_t,
list_head, and count never initialized. __svc_create() returns the
half-constructed svc_serv to nfsd, lockd, or the NFS callback service
anyway.

Once that service is live, the hot-path increments in
svc_xprt_enqueue(), svc_handle_xprt(), and
svc_pool_wake_idle_thread() reach a counter whose backing pointer is
NULL. The pointer is a per-cpu offset, so the access does not fault:
it resolves to offset zero of the current CPU's per-cpu area and
silently corrupts whatever variable lives there. A
/proc/fs/nfsd/pool_stats read walks the same NULL per-cpu storage and
returns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on
the never-initialized lock.

Creating the broken service requires a percpu allocation failure during
RPC server startup, so it is reachable only by a local administrator
under memory pressure or fault injection; a remote peer cannot induce
the bad state on its own.

Check each percpu_counter_init() return value in __svc_create() and
fail when an allocation fails, unwinding the counters already set up
in the current pool and in every pool initialized before it. A
discrete percpu_counter_destroy() per counter at teardown frees each
per-cpu allocation exactly once.

Fixes: ccf08bed6e ("SUNRPC: Replace pool stats with per-CPU variables")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-tier2-local-v2-2-5a0fd532db57@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This commit is contained in:
Chuck Lever
2026-05-30 20:42:53 -04:00
committed by Chuck Lever
parent 5ce1ed6159
commit 43e11e1647
1 changed files with 39 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
net/sunrpc/svc.c
View File

@@ -476,6 +476,35 @@ __svc_init_bc(struct svc_serv *serv)
}
#endif
static int svc_pool_init_counters(struct svc_pool *pool)
{
int err;
err = percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
if (err)
return err;
err = percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
if (err)
goto err_sockets;
err = percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
if (err)
goto err_threads;
return 0;
err_threads:
percpu_counter_destroy(&pool->sp_sockets_queued);
err_sockets:
percpu_counter_destroy(&pool->sp_messages_arrived);
return err;
}
static void svc_pool_destroy_counters(struct svc_pool *pool)
{
percpu_counter_destroy(&pool->sp_messages_arrived);
percpu_counter_destroy(&pool->sp_sockets_queued);
percpu_counter_destroy(&pool->sp_threads_woken);
}
/*
* Create an RPC service
*/
@@ -540,12 +569,18 @@ __svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
INIT_LIST_HEAD(&pool->sp_all_threads);
init_llist_head(&pool->sp_idle_threads);
percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
if (svc_pool_init_counters(pool))
goto out_err;
}
return serv;
out_err:
while (i--)
svc_pool_destroy_counters(&serv->sv_pools[i]);
kfree(serv->sv_pools);
kfree(serv);
return NULL;
}
/**
@@ -624,9 +659,7 @@ svc_destroy(struct svc_serv **servp)
for (i = 0; i < serv->sv_nrpools; i++) {
struct svc_pool *pool = &serv->sv_pools[i];
percpu_counter_destroy(&pool->sp_messages_arrived);
percpu_counter_destroy(&pool->sp_sockets_queued);
percpu_counter_destroy(&pool->sp_threads_woken);
svc_pool_destroy_counters(pool);
}
kfree(serv->sv_pools);
kfree(serv);