• santosh.shilimkar@oracle.com's avatar
    RDS: Fix rds MR reference count in rds_rdma_unuse() · 3f6b3143
    santosh.shilimkar@oracle.com authored
    rds_rdma_unuse() drops the mr reference count which it hasn't
    taken. Correct way of removing mr is to remove mr from the tree
    and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
    its reference count. Whichever thread holds last reference will free
    the mr via rds_mr_put()
    
    This bug was triggering weird null pointer crashes. One if the trace
    for it is captured below.
    
    BUG: unable to handle kernel NULL pointer dereference at
    0000000000000104
    IP: [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma]
    PGD 4366fa067 PUD 4366f9067 PMD 0
    Oops: 0000 [#1] SMP
    
    [...]
    
    task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
    RIP: 0010:[<ffffffffa0899471>]  [<ffffffffa0899471>]
    rds_ib_free_mr+0x31/0x130 [rds_rdma]
    RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
    RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
    RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
    R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
    R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
    FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
    knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
    Stack:
     ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
     ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
     0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
    Call Trace:
     <IRQ>
     [<ffffffffa087a38b>] rds_destroy_mr+0x8b/0xa0 [rds]
     [<ffffffffa087a3b6>] __rds_put_mr_final+0x16/0x30 [rds]
     [<ffffffffa087a492>] rds_rdma_unuse+0xc2/0x120 [rds]
     [<ffffffffa08766d3>] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
     [<ffffffffa0876782>] rds_recv_incoming+0x92/0x200 [rds]
     [<ffffffffa0895269>] rds_ib_process_recv+0x259/0x320 [rds_rdma]
     [<ffffffffa08962a8>] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
     [<ffffffff810dcd78>] ? __remove_hrtimer+0x58/0x90
     [<ffffffff810799e1>] tasklet_action+0xb1/0xc0
     [<ffffffff81079b52>] __do_softirq+0xe2/0x290
     [<ffffffff81079df6>] irq_exit+0xa6/0xb0
     [<ffffffff81613915>] do_IRQ+0x65/0xf0
     [<ffffffff816118ab>] common_interrupt+0x6b/0x6b
    Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
    Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    3f6b3143
rdma.c 22.5 KB