In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: do not repeat ceph_trim_dentries() if no progress possible<\/p>\n
ceph_cap_reclaim_work() re-queues itself for as long as
\nceph_trim_dentries() returns -EAGAIN, which happens whenever a lease
\nwalk exhausts its `nr_to_scan` budget. This creates a busy loop that
\nconsumes CPU without making any progress when there is nothing to
\nreclaim: with no cap pressure (`count==0`) and every scanned lease
\nstill valid, each pass runs the full scan budget down to zero and
\nreturns `-EAGAIN`, only to be queued again immediately.<\/p>\n
The dir-lease walk made this worse. When `expire_dir_lease` is
\n`false` (i.e. we have no intention of reclaiming dir leases),
\n__dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH`
\nmoves the dentry to the tail of the list and resets `di->time` via
\n__dentry_dir_lease_touch(), so a walk over N valid leases pointlessly
\nrewrote the list, refreshed the timestamps (preventing them from ever
\naging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN`
\nrequeue.<\/p>\n
Fix this in three steps:<\/p>\n
– Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is
\n `false`. If we are not going to reclaim the lease, leave it in
\n place instead of churning the list and resetting its timestamp; the
\n walk then terminates naturally (or via `STOP` at the first fresh
\n lease).<\/p>\n
– Only return `-EAGAIN` from the first (dentry-lease) walk when something
\n was actually freed. A full batch that frees nothing means retrying
\n the same list immediately is futile; fall through to the dir-lease
\n walk instead.<\/p>\n
– After both walks, bail out with success (0) when nothing was freed
\n and there is no cap pressure (`count==0`). There is no reason to
\n keep retrying when we are not over the cap limit and made no
\n progress.<\/p>\n
Under real cap pressure (`count>0`) the reclaim path is unchanged and
\nstill retries via `-EAGAIN`.<\/p>\n
Without this patch, I saw 500 ceph_trim_dentries() calls per second on
\nour web servers. This is very visible in `\/proc\/lock_stat` (5 minute
\ncapture):<\/p>\n
class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg<\/p>\n
&mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00
\n ———————–
\n &mdsc->dentry_list_lock 111736 [] __ceph_dentry_dir_lease_touch+0x7c\/0xa8
\n &mdsc->dentry_list_lock 2631 [] __dentry_leases_walk+0x64\/0x2c8
\n &mdsc->dentry_list_lock 3878 [] __ceph_dentry_lease_touch+0x5c\/0xa8
\n &mdsc->dentry_list_lock 9973 [] __dentry_lease_unlist+0x50\/0xa0
\n ———————–
\n &mdsc->dentry_list_lock 123621 [] __dentry_leases_walk+0x64\/0x2c8
\n &mdsc->dentry_list_lock 1822 [] __ceph_dentry_dir_lease_touch+0x7c\/0xa8
\n &mdsc->dentry_list_lock 2720 [] __dentry_lease_unlist+0x50\/0xa0
\n &mdsc->dentry_list_lock 55 [] __ceph_dentry_lease_touch+0x5c\/0xa8<\/p>\n
With this patch:<\/p>\n
class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg<\/p>\n
&mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27
\n ———————–
\n &mdsc->dentry_list_lock 1029 [] __ceph_dentry_dir_lease_touch+0x7c\/0xa8
\n &mdsc->dentry_list_lock 1
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: do not repeat ceph_trim_dentries() if no progress possible<\/p>\n
ceph_cap_reclaim_work() re-queues itself for as long as
\nceph_trim<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21569","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}