svn commit: r363210 - head/sys/fs/nfsclient

[Rick Macklem]

Author: rmacklem
Date: Wed Jul 15 01:26:28 2020
New Revision: 363210
URL: https://svnweb.freebsd.org/changeset/base/363210

Log:
  Fix the pNFS flexible file layout client for servers with small write size.
  
  The code in nfscl_dofflayout() loops when a flexible file layout server
  provides a small write data limit (no extant server is known to do this).
  If/when it looped, it erroneously reused the "drpc" argument for the
  mirror worker thread, corrupting it.
  This patch fixes the problem by only using the calling thread after the
  first loop iteration.
  
  Found during testing by simulating a server with a small write size.
  
  Since no extant pNFS server is known to provide a small write size,
  this fix it not needed in practice at this time.
  
  MFC after:	2 weeks

Modified:
  head/sys/fs/nfsclient/nfs_clrpcops.c

Modified: head/sys/fs/nfsclient/nfs_clrpcops.c
==============================================================================
--- head/sys/fs/nfsclient/nfs_clrpcops.c	Wed Jul 15 00:13:15 2020	(r363209)
+++ head/sys/fs/nfsclient/nfs_clrpcops.c	Wed Jul 15 01:26:28 2020	(r363210)
@@ -6248,10 +6248,17 @@ nfscl_dofflayoutio(vnode_t vp, struct uio *uiop, int *
 				NFSCL_DEBUG(4, "mcopy reloff=%d xfer=%jd\n",
 				    rel_off, (uintmax_t)xfer);
 				/*
-				 * Do last write to a mirrored DS with this
+				 * Do the writes after the first loop iteration
+				 * and the write for the last mirror via this
 				 * thread.
+				 * This loop only iterates for small values
+				 * of nfsdi_wsize, which may never occur in
+				 * practice.  However, the drpc is completely
+				 * used by the first iteration and, as such,
+				 * cannot be used after that.
 				 */
-				if (mirror < flp->nfsfl_mirrorcnt - 1)
+				if (mirror < flp->nfsfl_mirrorcnt - 1 &&
+				    rel_off == 0)
 					error = nfsio_writedsmir(vp, iomode,
 					    must_commit, stateidp, *dspp, off,
 					    xfer, fhp, m, dp->nfsdi_vers,