Commit ffc4d9b1 authored Dec 16, 2015 by Chuck Lever Committed by Anna Schumaker Dec 18, 2015

xprtrdma: xprt_rdma_free() must not release backchannel reqs



Preserve any rpcrdma_req that is attached to rpc_rqst's allocated
for the backchannel. Otherwise, after all the pre-allocated
backchannel req's are consumed, incoming backward calls start
writing on freed memory.

Somehow this hunk got lost.

Fixes: f531a5db ('xprtrdma: Pre-allocate backward rpc_rqst')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Devesh Sharma <devesh.sharma@avagotech.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

parent 9b06688b

net/sunrpc/xprtrdma/transport.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -576,6 +576,9 @@ xprt_rdma_free(void *buffer)

		rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]);
		req = rb->rg_owner;
		if (req->rl_backchannel)
		return;

		r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);

		dprintk("RPC: %s: called on 0x%p\n", __func__, req->rl_reply);