From nobody Wed Oct 14 01:24:04 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4D4n6LMhz6wGb1 for ; Wed, 14 Oct 2026 01:24:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4D4n5RfCz4yHQ for ; Wed, 14 Oct 2026 01:24:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791941049; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qZOek0o5l9GaRemqq3iC9IZz0jjXUOVjVqMay1Cwuwg=; b=OMORv4P9GZYQHMYIjrZbdbI2uWJ3bvjnqk2iklSUlwx/kmF6E5e+CGUXadnthIx823aPbj gNAblpia8DlntPbiQomZ9GlMKDKkpNKUQXzEy8LYzD6qn7U4ur7AhDyWHyWbWvmwwAxlBV hs06Vf0/TY6RFJPjjnWhvXyN6s01we+Er7DB2YHOYU0si0CeNamLMnogVwrur9lgqenqsi /YHc7DiS0Tb0vtPb4et+AhCxOnl0nPP+p4cXXcHMN7zkBwiUhLVGVHxDoWsFy/oWehVmD+ tAJLBUtrCWcB3V0Zi+l4vPZNyUyzjGnDRAU4ZBMnz4sdE6CSx4ZnzvBcjse70g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791941049; b=Uckf2dKeofZX7/Qmswe6U2rN6Dtafhep8wwC+VUQk/U/qSeamwOJeyuuIcHd445gz04285 4w6SxsjYbn8JIrK4W/zA2pLSkLRYWTZZ+9Ur1UTMiLAcbP5FMes/AWdEZ21+o5yhlnwlDO C3A5yXEJ0ZltEQ2/WfovtWDS3r1YygCy99L868KNWXhcgYFuRHXDnyStPN/eDNWcuOU2gm hF+neqmxoyavvwG0AEiOwC9+bGp6QWxyOQCPQF1NEWLvm6D1RgRFcr6OuONv6DqFSmnoEf 7/iAWuBsg9g4dx7G8fP3Y6S3MG7Bqw7Z2I0mCJzlPslqnwIETtrBi7h5vWbukA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791941049; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qZOek0o5l9GaRemqq3iC9IZz0jjXUOVjVqMay1Cwuwg=; b=kwwwarbj3AQi78r0BQB/f9ZqMB42F/tSWr5VvNejjTQSDSal7xYQRyQDtu8or5FB6ZCDAU Ta8cXbq0CiUMzFBnrjvryp+ThpsGRFyZ9MRttk/dc3ZmCSy4ibn1xeDbJTXvFt6ZyveXAT JnqXx3LiGFsNEyuFNoyQ47aeVvA/EIo33sQ9EH01G8kyU/CLySa7czFWTmmMZDxNZXdEUk 2yrnNnlY1rPJJtsqaiPFWuqN/rgGxszHG7IvrvNvAZvuGFHVt3RGF4iNATPE+/qXbE+OQI ijOeuAf6OhncARF34YzYyDVjTBur8o3oWMQ53gVt3GZ0ucTHRo2CG528ubN1LQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4D4n4VRVzhGb for ; Wed, 14 Oct 2026 01:24:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18a86 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 01:24:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: J. David From: Rick Macklem Subject: git: c556f4e1b1e1 - stable/14 - nfscl: Fix oddball cases for session slot release List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c556f4e1b1e15ef49fa49a7cd795902e5f90c47d Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 01:24:04 +0000 Message-Id: <6aced9b4.18a86.6b02982b@gitrepo.freebsd.org> The branch stable/14 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=c556f4e1b1e15ef49fa49a7cd795902e5f90c47d commit c556f4e1b1e15ef49fa49a7cd795902e5f90c47d Author: J. David AuthorDate: 2026-10-07 01:52:19 +0000 Commit: Rick Macklem CommitDate: 2026-10-14 01:21:57 +0000 nfscl: Fix oddball cases for session slot release We have identified some cases where silent slot loss can occur when operations on NFS mounts are aborted. We experience this when using NFSv4.2, but it likely also occurs with NFSv4.1. A slot is acquired for compound operations by nfsv4_setsequence() and freed by newnfs_request(). Any call path that abandons the compound before reaching newnfs_request() loses the slot permanently. We identified four call sites where this happens, one of which where it actually does happen for us in a semi-reproducible way, which allowed us to develop a candidate patch, attached. The patch adds one function, nfsv4_freeunsentslot(), to nfs_clcomsubs.c. It is called from each of the four call sites: nfsrpc_writerpc(), nfsrpc_writeds(), and two in nfsrpc_setextattr(). nfsv4_freeunsentslot() calls nfsv4_freeslot() with resetseq set to true because the aborted RPC will never be sent and therefore the slot sequence ID should not advance. With this patch and other diagnostics, we have confirmed that slot loss does not occur under the conditions that otherwise cause it in our environment. PR: 298416 (cherry picked from commit 77a7a48a1cb003831ff1d4342b1974fc7f79381e) --- sys/fs/nfs/nfs_var.h | 2 ++ sys/fs/nfsclient/nfs_clcomsubs.c | 18 ++++++++++++++++++ sys/fs/nfsclient/nfs_clrpcops.c | 4 ++++ 3 files changed, 24 insertions(+) diff --git a/sys/fs/nfs/nfs_var.h b/sys/fs/nfs/nfs_var.h index 7c62c7b32c16..f2556ec3b36e 100644 --- a/sys/fs/nfs/nfs_var.h +++ b/sys/fs/nfs/nfs_var.h @@ -383,6 +383,8 @@ int nfscl_wcc_data(struct nfsrv_descript *, vnode_t, int nfsm_loadattr(struct nfsrv_descript *, struct nfsvattr *); int nfscl_request(struct nfsrv_descript *, vnode_t, NFSPROC_T *, struct ucred *); +void nfsv4_freeunsentslot(struct nfsmount *, struct nfsclsession *, + struct nfsrv_descript *); /* nfs_nfsdsubs.c */ void nfsd_fhtovp(struct nfsrv_descript *, struct nfsrvfh *, int, diff --git a/sys/fs/nfsclient/nfs_clcomsubs.c b/sys/fs/nfsclient/nfs_clcomsubs.c index 270f39d03c90..4dd1d4d773d9 100644 --- a/sys/fs/nfsclient/nfs_clcomsubs.c +++ b/sys/fs/nfsclient/nfs_clcomsubs.c @@ -444,3 +444,21 @@ nfscl_lockderef(struct nfsv4lock *lckp) } NFSUNLOCKCLSTATE(); } + +/* + * Free the session slot of a compound that was built but will not be sent + * to the server. + */ +void +nfsv4_freeunsentslot(struct nfsmount *nmp, struct nfsclsession *sep, + struct nfsrv_descript *nd) +{ + + if (nmp == NULL || (nd->nd_flag & (ND_NFSV41 | ND_HASSLOTID)) != + (ND_NFSV41 | ND_HASSLOTID)) + return; + if (sep == NULL) + sep = nfsmnt_mdssession(nmp); + if (sep != NULL) + nfsv4_freeslot(sep, nd->nd_slotid, true); +} diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index b704169dbaab..176dd0354ee5 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -2101,6 +2101,7 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, int *iomode, } error = nfsm_uiombuf(nd, uiop, len); if (error != 0) { + nfsv4_freeunsentslot(nmp, NULL, nd); m_freem(nd->nd_mreq); free(nd, M_TEMP); return (error); @@ -7070,6 +7071,7 @@ nfsrpc_writeds(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit, *tl = txdr_unsigned(len); error = nfsm_uiombuf(nd, uiop, len); if (error != 0) { + nfsv4_freeunsentslot(nmp, &dsp->nfsclds_sess, nd); m_freem(nd->nd_mreq); return (error); } @@ -9218,6 +9220,7 @@ nfsrpc_setextattr(vnode_t vp, const char *name, struct uio *uiop, NFSCL_REQSTART(nd, NFSPROC_SETEXTATTR, vp, cred); if (uiop->uio_resid > nd->nd_maxreq) { /* nd_maxreq is set by NFSCL_REQSTART(). */ + nfsv4_freeunsentslot(VFSTONFS(vp->v_mount), NULL, nd); m_freem(nd->nd_mreq); return (EINVAL); } @@ -9228,6 +9231,7 @@ nfsrpc_setextattr(vnode_t vp, const char *name, struct uio *uiop, *tl = txdr_unsigned(uiop->uio_resid); error = nfsm_uiombuf(nd, uiop, uiop->uio_resid); if (error != 0) { + nfsv4_freeunsentslot(VFSTONFS(vp->v_mount), NULL, nd); m_freem(nd->nd_mreq); return (error); }