From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Sat, 26 Jun 2021 15:50:41 +0800
Subject: [PATCH] SUNRPC: Fix the batch tasks count wraparound.
Git-commit: fcb170a9d825d7db4a3fb870b0300f5a40a8d096
Patch-mainline: v5.14
References: git-fixes

The 'queue->nr' will wraparound from 0 to 255 when only current
priority queue has tasks. This maybe lead a deadlock same as commit
dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):

Privileged delegreturn task is queued to privileged list because all
the slots are assigned. When non-privileged task complete and release
the slot, a non-privileged maybe picked out. It maybe allocate slot
failed when the session on draining.

If the 'queue->nr' has wraparound to 255, and no enough slot to
service it, then the privileged delegreturn will lost to wake up.

So we should avoid the wraparound on 'queue->nr'.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Acked-by: NeilBrown <neilb@suse.com>

---
 net/sunrpc/sched.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -493,8 +493,10 @@ static struct rpc_task *__rpc_find_next_
 	if (!list_empty(q)) {
 		task = list_entry(q->next, struct rpc_task, u.tk_wait.list);
 		if (queue->owner == task->tk_owner) {
-			if (--queue->nr)
+			if (queue->nr) {
+				queue->nr--;
 				goto out;
+			}
 			list_move_tail(&task->u.tk_wait.list, q);
 		}
 		/*