linux/net
Tina Yang 35b52c7053 RDS: Fix corrupted rds_mrs
On second look at this bug (OFED ), it seems that the
collision is not with the retransmission queue (packet acked
by the peer), but with the local send completion.  A theoretical
sequence of events (from time t0 to t3) is thought to be as
follows,

Thread 
t0:
    sock_release
    rds_release
    rds_send_drop_to /* wait on send completion */
t2:
    rds_rdma_drop_keys()   /* destroy & free all mrs */

Thread 
t1:
    rds_ib_send_cq_comp_handler
    rds_ib_send_unmap_rm
    rds_message_unmapped   /* wake up  @ t0 */
t3:
    rds_message_put
    rds_message_purge
    rds_mr_put   /* memory corruption detected */

The problem with the rds_rdma_drop_keys() is it could
remove a mr's refcount more than its due (i.e. repeatedly
as long as it still remains in the tree (mr->r_refcount > 0)).
Theoretically it should remove only one reference - reference
by the tree.

        /* Release any MRs associated with this socket */
        while ((node = rb_first(&rs->rs_rdma_keys))) {
                mr = container_of(node, struct rds_mr, r_rb_node);
                if (mr->r_trans == rs->rs_transport)
                        mr->r_invalidate = 0;
                rds_mr_put(mr);
        }

I think the correct way of doing it is to remove the mr from
the tree and rds_destroy_mr it first, then a rds_mr_put()
to decrement its reference count by one.  Whichever thread
holds the last reference will free the mr via rds_mr_put().

Signed-off-by: Tina Yang <tina.yang@oracle.com>
Signed-off-by: Andy Grover <andy.grover@oracle.com>
2010-09-08 18:07:31 -07:00
..
9p net/9p/trans_fd.c: Fix unsigned return type 2010-09-06 18:48:42 -07:00
802
8021q vlan: Use vlan_dev_real_dev in vlan_hwaccel_do_receive 2010-08-31 13:37:05 -07:00
appletalk
atm atm: remove a net_device_stats clear 2010-08-19 00:14:36 -07:00
ax25 net/ax25: Use available error codes 2010-08-18 14:26:31 -07:00
bluetooth net: poll() optimizations 2010-09-06 18:48:45 -07:00
bridge bridge: avoid ethtool on non running interface 2010-08-25 16:36:51 -07:00
caif net/caifcaif_dev.c: Use netdev_<level> 2010-09-06 18:48:43 -07:00
can net: simplify flags for tx timestamping 2010-08-19 00:08:30 -07:00
core net: poll() optimizations 2010-09-06 18:48:45 -07:00
dcb
dccp dccp ccid-3: use per-route RTO or TCP RTO as fallback 2010-08-30 13:45:28 -07:00
decnet net/decnet: Adjust confusing if indentation 2010-08-16 21:06:30 -07:00
dns_resolver DNS: If the DNS server returns an error, allow that to be cached [ver ] 2010-08-11 17:11:28 +00:00
dsa phylib: available for any speed ethernet 2010-08-11 23:03:50 -07:00
econet econet: kill unnecessary spin_lock_init() 2010-08-28 15:37:03 -07:00
ethernet net: use scnprintf() to avoid potential buffer overflow 2010-08-26 14:11:49 -07:00
ieee802154
ipv4 net: arp: code cleanup 2010-09-02 10:12:06 -07:00
ipv6 ipv6: add special mode forwarding=2 to send RS while configured as router 2010-09-03 09:43:14 -07:00
ipx
irda irda: use net_device_stats from struct net_device 2010-08-21 23:32:31 -07:00
iucv
key
l2tp net: another last_rx round 2010-09-02 09:19:32 -07:00
lapb
llc
mac80211 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem 2010-09-02 13:30:07 -04:00
netfilter ipvs: use pkts for SCTP too 2010-09-02 10:04:18 -07:00
netlabel
netlink netlink: fix compat recvmsg 2010-08-18 23:35:58 -07:00
netrom
packet net: simplify flags for tx timestamping 2010-08-19 00:08:30 -07:00
phonet Phonet: do not set POLLOUT in case of send buffer overflow 2010-08-31 13:04:33 -07:00
rds RDS: Fix corrupted rds_mrs 2010-09-08 18:07:31 -07:00
rfkill
rose net/rose: Use GFP_ATOMIC 2010-08-01 00:32:12 -07:00
rxrpc Add a dummy printk function for the maintenance of unused printks 2010-08-12 09:51:35 -07:00
sched tc: add meta match on receive hash 2010-08-24 14:48:10 -07:00
sctp net: poll() optimizations 2010-09-06 18:48:45 -07:00
sunrpc nfs: update for module_param_named API change 2010-08-11 23:04:15 +09:30
tipc tipc: Fix misleading error code when enabling Ethernet bearers 2010-09-06 18:12:57 -07:00
unix net: poll() optimizations 2010-09-06 18:48:45 -07:00
wanrouter net: autoconvert trivial BKL users to private mutex 2010-07-12 20:21:47 -07:00
wimax
wireless net/wireless: Remove double test 2010-08-31 14:20:40 -04:00
x25
xfrm xfrm: Use GFP_ATOMIC in xfrm_compile_policy 2010-08-14 22:38:09 -07:00
compat.c
Kconfig DNS: Separate out CIFS DNS Resolver code 2010-08-05 17:17:51 +00:00
Makefile DNS: Separate out CIFS DNS Resolver code 2010-08-05 17:17:51 +00:00
nonet.c
socket.c net: simplify flags for tx timestamping 2010-08-19 00:08:30 -07:00
sysctl_net.c
TUNABLE