leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3f6b314303
linux/net/rds
History
santosh.shilimkar@oracle.com 3f6b314303 RDS: Fix rds MR reference count in rds_rdma_unuse() 
rds_rdma_unuse() drops the mr reference count which it hasn't
taken. Correct way of removing mr is to remove mr from the tree
and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
its reference count. Whichever thread holds last reference will free
the mr via rds_mr_put()

This bug was triggering weird null pointer crashes. One if the trace
for it is captured below.

BUG: unable to handle kernel NULL pointer dereference at
0000000000000104
IP: [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma]
PGD 4366fa067 PUD 4366f9067 PMD 0
Oops: 0000 [#1] SMP

[...]

task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
RIP: 0010:[<ffffffffa0899471>]  [<ffffffffa0899471>]
rds_ib_free_mr+0x31/0x130 [rds_rdma]
RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
Stack:
 ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
 ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
 0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
Call Trace:
 <IRQ>
 [<ffffffffa087a38b>] rds_destroy_mr+0x8b/0xa0 [rds]
 [<ffffffffa087a3b6>] __rds_put_mr_final+0x16/0x30 [rds]
 [<ffffffffa087a492>] rds_rdma_unuse+0xc2/0x120 [rds]
 [<ffffffffa08766d3>] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
 [<ffffffffa0876782>] rds_recv_incoming+0x92/0x200 [rds]
 [<ffffffffa0895269>] rds_ib_process_recv+0x259/0x320 [rds_rdma]
 [<ffffffffa08962a8>] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
 [<ffffffff810dcd78>] ? __remove_hrtimer+0x58/0x90
 [<ffffffff810799e1>] tasklet_action+0xb1/0xc0
 [<ffffffff81079b52>] __do_softirq+0xe2/0x290
 [<ffffffff81079df6>] irq_exit+0xa6/0xb0
 [<ffffffff81613915>] do_IRQ+0x65/0xf0
 [<ffffffff816118ab>] common_interrupt+0x6b/0x6b

Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-25 16:28:10 -07:00
..
af_rds.c RDS: add a sock_destruct callback debug aid 2015-08-25 13:35:30 -07:00
bind.c RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net 2015-08-07 11:29:57 -07:00
cong.c rds: rds_cong_queue_updates needs to defer the congestion update transmission 2015-02-11 14:35:44 -08:00
connection.c RDS: make sure we post recv buffers 2015-08-25 13:35:30 -07:00
ib_cm.c RDS: Don't destroy the rdma id until after we're done using it 2015-08-25 13:35:31 -07:00
ib_rdma.c RDS: Fix assertion level from fatal to warning 2015-08-25 13:35:31 -07:00
ib_recv.c RDS: fix the dangling reference to rds_ib_incoming_slab 2015-08-25 16:28:10 -07:00
ib_ring.c
ib_send.c RDS: Make sure we do a signaled send for large-send 2015-08-25 13:35:30 -07:00
ib_stats.c RDS: Move atomic stats from general to ib-specific area 2010-09-08 18:12:20 -07:00
ib_sysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
ib.c RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net 2015-08-07 11:29:57 -07:00
ib.h RDS: make sure we post recv buffers 2015-08-25 13:35:30 -07:00
info.c rds: fix an integer overflow test in rds_info_getsockopt() 2015-08-03 15:20:16 -07:00
info.h
iw_cm.c RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net 2015-08-07 11:29:57 -07:00
iw_rdma.c rds: avoid potential stack overflow 2015-03-12 00:28:01 -04:00
iw_recv.c rds: switch ->inc_copy_to_user() to passing iov_iter 2014-11-24 05:16:43 -05:00
iw_ring.c
iw_send.c rds: re-entry of rds_ib_xmit/rds_iw_xmit 2015-06-02 09:22:31 -04:00
iw_stats.c
iw_sysctl.c rds: remove the unneed NULL checking 2014-05-09 15:59:45 -04:00
iw.c RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net 2015-08-07 11:29:57 -07:00
iw.h rds: switch ->inc_copy_to_user() to passing iov_iter 2014-11-24 05:16:43 -05:00
Kconfig net/rds: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:02 -08:00
loop.c RDS: use gfp flags from caller in conn_alloc() 2012-03-22 19:29:58 -04:00
loop.h
Makefile Net: rds: Makefile: Remove deprecated items 2010-11-22 08:16:15 -08:00
message.c rds: Make rds_message_copy_from_user() return 0 on success. 2015-02-07 22:41:56 -08:00
page.c net: Fix (nearly-)kernel-doc comments for various functions 2012-07-10 23:13:45 -07:00
rdma_transport.c RDS: check for valid cm_id before initiating connection 2015-08-25 13:35:31 -07:00
rdma_transport.h rds: make local functions/variables static 2010-10-21 04:26:39 -07:00
rdma.c RDS: Fix rds MR reference count in rds_rdma_unuse() 2015-08-25 16:28:10 -07:00
rds.h RDS: make sure we post recv buffers 2015-08-25 13:35:30 -07:00
recv.c net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
send.c RDS: return EMSGSIZE for oversize requests before processing/queueing 2015-08-25 13:35:31 -07:00
stats.c net/rds: zero last byte for strncpy 2013-03-08 00:35:44 -05:00
sysctl.c net: rds: use correct size for max unacked packets and bytes 2015-02-04 16:07:27 -08:00
tcp_connect.c RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns. 2015-08-07 11:29:58 -07:00
tcp_listen.c RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns. 2015-08-07 11:29:58 -07:00
tcp_recv.c rds: switch ->inc_copy_to_user() to passing iov_iter 2014-11-24 05:16:43 -05:00
tcp_send.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
tcp_stats.c net: rds: fix const array syntax 2011-07-01 16:16:19 -07:00
tcp.c RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns. 2015-08-07 11:29:58 -07:00
tcp.h RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns. 2015-08-07 11:29:58 -07:00
threads.c net/rds: call rds_conn_drop instead of open code it at rds_connect_complete 2014-10-03 12:51:59 -07:00
transport.c RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net 2015-08-07 11:29:57 -07:00