santosh.shilimkar@oracle.com 3f6b314303 RDS: Fix rds MR reference count in rds_rdma_unuse() ...

rds_rdma_unuse() drops the mr reference count which it hasn't
taken. Correct way of removing mr is to remove mr from the tree
and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
its reference count. Whichever thread holds last reference will free
the mr via rds_mr_put()

This bug was triggering weird null pointer crashes. One if the trace
for it is captured below.

BUG: unable to handle kernel NULL pointer dereference at
0000000000000104
IP: [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma]
PGD 4366fa067 PUD 4366f9067 PMD 0
Oops: 0000 [#1] SMP

[...]

task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
RIP: 0010:[<ffffffffa0899471>]  [<ffffffffa0899471>]
rds_ib_free_mr+0x31/0x130 [rds_rdma]
RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
Stack:
 ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
 ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
 0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
Call Trace:
 <IRQ>
 [<ffffffffa087a38b>] rds_destroy_mr+0x8b/0xa0 [rds]
 [<ffffffffa087a3b6>] __rds_put_mr_final+0x16/0x30 [rds]
 [<ffffffffa087a492>] rds_rdma_unuse+0xc2/0x120 [rds]
 [<ffffffffa08766d3>] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
 [<ffffffffa0876782>] rds_recv_incoming+0x92/0x200 [rds]
 [<ffffffffa0895269>] rds_ib_process_recv+0x259/0x320 [rds_rdma]
 [<ffffffffa08962a8>] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
 [<ffffffff810dcd78>] ? __remove_hrtimer+0x58/0x90
 [<ffffffff810799e1>] tasklet_action+0xb1/0xc0
 [<ffffffff81079b52>] __do_softirq+0xe2/0x290
 [<ffffffff81079df6>] irq_exit+0xa6/0xb0
 [<ffffffff81613915>] do_IRQ+0x65/0xf0
 [<ffffffff816118ab>] common_interrupt+0x6b/0x6b

Signed-off-by: Santosh Shilimkar <ssantosh@kernel.org>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-08-25 16:28:10 -07:00

..

af_rds.c

RDS: add a sock_destruct callback debug aid

2015-08-25 13:35:30 -07:00

bind.c

RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net

2015-08-07 11:29:57 -07:00

cong.c

rds: rds_cong_queue_updates needs to defer the congestion update transmission

2015-02-11 14:35:44 -08:00

connection.c

RDS: make sure we post recv buffers

2015-08-25 13:35:30 -07:00

ib_cm.c

RDS: Don't destroy the rdma id until after we're done using it

2015-08-25 13:35:31 -07:00

ib_rdma.c

RDS: Fix assertion level from fatal to warning

2015-08-25 13:35:31 -07:00

ib_recv.c

RDS: fix the dangling reference to rds_ib_incoming_slab

2015-08-25 16:28:10 -07:00

ib_ring.c

RDS/IW+IB: Set recv ring low water mark to 1/2 full.

2009-04-09 17:21:14 -07:00

ib_send.c

RDS: Make sure we do a signaled send for large-send

2015-08-25 13:35:30 -07:00

ib_stats.c

RDS: Move atomic stats from general to ib-specific area

2010-09-08 18:12:20 -07:00

ib_sysctl.c

net: Convert uses of typedef ctl_table to struct ctl_table

2013-06-13 02:36:09 -07:00

ib.c

RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net

2015-08-07 11:29:57 -07:00

ib.h

RDS: make sure we post recv buffers

2015-08-25 13:35:30 -07:00

info.c

rds: fix an integer overflow test in rds_info_getsockopt()

2015-08-03 15:20:16 -07:00

info.h

RDS: Info and stats

2009-02-26 23:39:25 -08:00

iw_cm.c

RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net

2015-08-07 11:29:57 -07:00

iw_rdma.c

rds: avoid potential stack overflow

2015-03-12 00:28:01 -04:00

iw_recv.c

rds: switch ->inc_copy_to_user() to passing iov_iter

2014-11-24 05:16:43 -05:00

iw_ring.c

RDS/IW+IB: Set recv ring low water mark to 1/2 full.

2009-04-09 17:21:14 -07:00

iw_send.c

rds: re-entry of rds_ib_xmit/rds_iw_xmit

2015-06-02 09:22:31 -04:00

iw_stats.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2009-09-15 09:39:44 -07:00

iw_sysctl.c

rds: remove the unneed NULL checking

2014-05-09 15:59:45 -04:00

iw.c

RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net

2015-08-07 11:29:57 -07:00

iw.h

rds: switch ->inc_copy_to_user() to passing iov_iter

2014-11-24 05:16:43 -05:00

Kconfig

net/rds: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:40:02 -08:00

loop.c

RDS: use gfp flags from caller in conn_alloc()

2012-03-22 19:29:58 -04:00

loop.h

RDS: loopback

2009-02-26 23:39:26 -08:00

Makefile

Net: rds: Makefile: Remove deprecated items

2010-11-22 08:16:15 -08:00

message.c

rds: Make rds_message_copy_from_user() return 0 on success.

2015-02-07 22:41:56 -08:00

page.c

net: Fix (nearly-)kernel-doc comments for various functions

2012-07-10 23:13:45 -07:00

rdma_transport.c

RDS: check for valid cm_id before initiating connection

2015-08-25 13:35:31 -07:00

rdma_transport.h

rds: make local functions/variables static

2010-10-21 04:26:39 -07:00

rdma.c

RDS: Fix rds MR reference count in rds_rdma_unuse()

2015-08-25 16:28:10 -07:00

rds.h

RDS: make sure we post recv buffers

2015-08-25 13:35:30 -07:00

recv.c

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

send.c

RDS: return EMSGSIZE for oversize requests before processing/queueing

2015-08-25 13:35:31 -07:00

stats.c

net/rds: zero last byte for strncpy

2013-03-08 00:35:44 -05:00

sysctl.c

net: rds: use correct size for max unacked packets and bytes

2015-02-04 16:07:27 -08:00

tcp_connect.c

RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.

2015-08-07 11:29:58 -07:00

tcp_listen.c

RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.

2015-08-07 11:29:58 -07:00

tcp_recv.c

rds: switch ->inc_copy_to_user() to passing iov_iter

2014-11-24 05:16:43 -05:00

tcp_send.c

arch: Mass conversion of smp_mb__*()

2014-04-18 14:20:48 +02:00

tcp_stats.c

net: rds: fix const array syntax

2011-07-01 16:16:19 -07:00

tcp.c

RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.

2015-08-07 11:29:58 -07:00

tcp.h

RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.

2015-08-07 11:29:58 -07:00

threads.c

net/rds: call rds_conn_drop instead of open code it at rds_connect_complete

2014-10-03 12:51:59 -07:00

transport.c

RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net

2015-08-07 11:29:57 -07:00