* [PATCH v2] ocfs2/dlm: drain join handlers before releasing module text
@ 2026-10-22 9:09 Cen Zhang
2026-10-23 3:08 ` Joseph Qi
0 siblings, 1 reply; 2+ messages in thread
From: Cen Zhang @ 2026-10-22 9:09 UTC (permalink / raw)
To: mark, jlbec, joseph.qi
Cc: heming.zhao, ocfs2-devel, linux-kernel, stable, baijiaju1990,
jjzuming, zzzccc427
The code for a registered DLM handler must remain resident until its
last invocation finishes. dlm_unregister_net_handlers() only removes
dlm_join_handlers from the o2net registry. o2net_handler_get() takes a
kref on the wrapper, but that reference does not pin ocfs2_dlm text.
o2net_process_message() calls nh_func after dropping o2net_handler_lock.
With CONFIG_OCFS2_FS_O2CB=m, ocfs2_dlm can be loaded independently of
ocfs2_stack_o2cb while nodemanager continues handling messages from a
configured, heartbeating peer. If no dependent module or module reference
prevents normal unload, the following ordering is possible:
Receive worker Module unload
-------------- -------------
o2net_handler_get()
take wrapper kref
drop handler lock
<preempted>
dlm_exit()
unregister handlers
release DLM module text
call saved nh_func
in released module text
Use o2net_unregister_and_flush_handler_list() in the shared DLM
unregister helper. It first prevents new lookups, then waits for the
ordered o2net workqueue to drain, including a concurrent destruction of
that queue. The acquired invocation therefore finishes before dlm_exit()
returns and the loader releases the callback code. The same helper
covers partial registration and dlm_init() error unwind before module
memory is released.
Skip the drain when the private join-handler list is empty. Early
dlm_init() failures can reach this helper before any handler has been
published. Partial-registration failure also reaches it a second time
after the first call has already unregistered and drained the list.
Neither case needs to take o2net_wq_mutex or drain unrelated work.
The list is changed only by serialized module init/exit paths; a
nonempty list still uses the full unregister-and-flush helper.
Oops report as below:
Oops: int3: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 54 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware identification omitted.
Workqueue: o2net o2net_rx_until_empty [ocfs2_nodemanager]
RIP: 0010:0xffffffffc0423871
[Instruction byte dump omitted.]
Register dump omitted.
Call Trace:
<TASK>
? o2net_rx_until_empty+0x19b1/0x3300 [ocfs2_nodemanager]
? __pfx_o2net_rx_until_empty+0x10/0x10 [ocfs2_nodemanager]
? lock_acquire+0x190/0x300
? process_one_work+0x935/0x1b40
? process_one_work+0x834/0x1b40
? srso_alias_return_thunk+0x5/0xfbef5
? lock_release+0xc8/0x290
? srso_alias_return_thunk+0x5/0xfbef5
? process_one_work+0x9a8/0x1b40
? __pfx_process_one_work+0x10/0x10
? lock_acquire+0x190/0x300
? lock_is_held_type+0x8f/0x100
? srso_alias_return_thunk+0x5/0xfbef5
? worker_thread+0x65c/0xe40
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0x177/0x220
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_worker_thread+0x10/0x10
? kthread+0x351/0x460
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx_kthread+0x10/0x10
? ret_from_fork+0x659/0x940
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x74f/0xf70
? __pfx_kthread+0x10/0x10
? ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in: ocfs2_nodemanager [last unloaded: ocfs2_dlm]
---[ end trace 0000000000000000 ]---
Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Cc: <stable@vger.kernel.org>
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: LLM
---
Changes in v2:
- Skip unregister-and-flush when the private join-handler list is empty,
covering early dlm_init failures and the second cleanup after
partial-registration unwind.
- Retain the full unregister-and-flush helper for every nonempty list; do
not change the generic o2net helper.
Link to v1: https://lore.kernel.org/r/pm-ocfs2-objects-candidate-0076-v5-dd198d8a9358ad81f70e@gmail.com
fs/ocfs2/dlm/dlmdomain.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 97bb9400e24b..a7dc3da6dfc7 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -2215,7 +2215,8 @@ static LIST_HEAD(dlm_join_handlers);
static void dlm_unregister_net_handlers(void)
{
- o2net_unregister_handler_list(&dlm_join_handlers);
+ if (!list_empty(&dlm_join_handlers))
+ o2net_unregister_and_flush_handler_list(&dlm_join_handlers);
}
static int dlm_register_net_handlers(void)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH v2] ocfs2/dlm: drain join handlers before releasing module text
2026-10-22 9:09 [PATCH v2] ocfs2/dlm: drain join handlers before releasing module text Cen Zhang
@ 2026-10-23 3:08 ` Joseph Qi
0 siblings, 0 replies; 2+ messages in thread
From: Joseph Qi @ 2026-10-23 3:08 UTC (permalink / raw)
To: Cen Zhang, Andrew Morton
Cc: mark, jlbec, heming.zhao, ocfs2-devel, linux-kernel, stable,
baijiaju1990, jjzuming
On 10/22/26 5:09 PM, Cen Zhang wrote:
> The code for a registered DLM handler must remain resident until its
> last invocation finishes. dlm_unregister_net_handlers() only removes
> dlm_join_handlers from the o2net registry. o2net_handler_get() takes a
> kref on the wrapper, but that reference does not pin ocfs2_dlm text.
> o2net_process_message() calls nh_func after dropping o2net_handler_lock.
>
> With CONFIG_OCFS2_FS_O2CB=m, ocfs2_dlm can be loaded independently of
> ocfs2_stack_o2cb while nodemanager continues handling messages from a
> configured, heartbeating peer. If no dependent module or module reference
> prevents normal unload, the following ordering is possible:
>
> Receive worker Module unload
> -------------- -------------
> o2net_handler_get()
> take wrapper kref
> drop handler lock
> <preempted>
> dlm_exit()
> unregister handlers
> release DLM module text
> call saved nh_func
> in released module text
>
> Use o2net_unregister_and_flush_handler_list() in the shared DLM
> unregister helper. It first prevents new lookups, then waits for the
> ordered o2net workqueue to drain, including a concurrent destruction of
> that queue. The acquired invocation therefore finishes before dlm_exit()
> returns and the loader releases the callback code. The same helper
> covers partial registration and dlm_init() error unwind before module
> memory is released.
>
> Skip the drain when the private join-handler list is empty. Early
> dlm_init() failures can reach this helper before any handler has been
> published. Partial-registration failure also reaches it a second time
> after the first call has already unregistered and drained the list.
> Neither case needs to take o2net_wq_mutex or drain unrelated work.
> The list is changed only by serialized module init/exit paths; a
> nonempty list still uses the full unregister-and-flush helper.
>
> Oops report as below:
>
> Oops: int3: 0000 [#1] SMP KASAN NOPTI
> CPU: 2 UID: 0 PID: 54 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
>
> Hardware identification omitted.
>
> Workqueue: o2net o2net_rx_until_empty [ocfs2_nodemanager]
> RIP: 0010:0xffffffffc0423871
> [Instruction byte dump omitted.]
>
> Register dump omitted.
>
> Call Trace:
> <TASK>
> ? o2net_rx_until_empty+0x19b1/0x3300 [ocfs2_nodemanager]
> ? __pfx_o2net_rx_until_empty+0x10/0x10 [ocfs2_nodemanager]
> ? lock_acquire+0x190/0x300
> ? process_one_work+0x935/0x1b40
> ? process_one_work+0x834/0x1b40
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? lock_release+0xc8/0x290
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? process_one_work+0x9a8/0x1b40
> ? __pfx_process_one_work+0x10/0x10
> ? lock_acquire+0x190/0x300
> ? lock_is_held_type+0x8f/0x100
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? worker_thread+0x65c/0xe40
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __kthread_parkme+0x177/0x220
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __pfx_worker_thread+0x10/0x10
> ? kthread+0x351/0x460
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __pfx_kthread+0x10/0x10
> ? ret_from_fork+0x659/0x940
> ? __pfx_ret_from_fork+0x10/0x10
> ? srso_alias_return_thunk+0x5/0xfbef5
> ? __switch_to+0x74f/0xf70
> ? __pfx_kthread+0x10/0x10
> ? ret_from_fork_asm+0x1a/0x30
> </TASK>
> Modules linked in: ocfs2_nodemanager [last unloaded: ocfs2_dlm]
> ---[ end trace 0000000000000000 ]---
>
> Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> Assisted-by: LLM
Looks fine.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
> Changes in v2:
> - Skip unregister-and-flush when the private join-handler list is empty,
> covering early dlm_init failures and the second cleanup after
> partial-registration unwind.
> - Retain the full unregister-and-flush helper for every nonempty list; do
> not change the generic o2net helper.
>
> Link to v1: https://lore.kernel.org/r/pm-ocfs2-objects-candidate-0076-v5-dd198d8a9358ad81f70e@gmail.com
>
> fs/ocfs2/dlm/dlmdomain.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
> index 97bb9400e24b..a7dc3da6dfc7 100644
> --- a/fs/ocfs2/dlm/dlmdomain.c
> +++ b/fs/ocfs2/dlm/dlmdomain.c
> @@ -2215,7 +2215,8 @@ static LIST_HEAD(dlm_join_handlers);
>
> static void dlm_unregister_net_handlers(void)
> {
> - o2net_unregister_handler_list(&dlm_join_handlers);
> + if (!list_empty(&dlm_join_handlers))
> + o2net_unregister_and_flush_handler_list(&dlm_join_handlers);
> }
>
> static int dlm_register_net_handlers(void)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-23 3:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-22 9:09 [PATCH v2] ocfs2/dlm: drain join handlers before releasing module text Cen Zhang
2026-10-23 3:08 ` Joseph Qi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®