Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d42629b authored by Chuck Lever's avatar Chuck Lever Committed by J. Bruce Fields
Browse files

svcrdma: backchannel cannot share a page for send and rcv buffers 



The underlying transport releases the page pointed to by rq_buffer
during xprt_rdma_bc_send_request. When the backchannel reply arrives,
rq_rbuffer then points to freed memory.

Fixes: 68778945 ('SUNRPC: Separate buffer pointers for RPC ...')
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Cc: Jeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 18e601d6

net/sunrpc/xprtrdma/svc_rdma_backchannel.c

+10 −3
Original line number Diff line number Diff line
@@ -177,19 +177,26 @@ xprt_rdma_bc_allocate(struct rpc_task *task) 
		return -EINVAL;

	}



	/* svc_rdma_sendto releases this page */

	page = alloc_page(RPCRDMA_DEF_GFP);

	if (!page)

		return -ENOMEM;



	rqst->rq_buffer = page_address(page);

	rqst->rq_rbuffer = (char *)rqst->rq_buffer + rqst->rq_callsize;



	rqst->rq_rbuffer = kmalloc(rqst->rq_rcvsize, RPCRDMA_DEF_GFP);

	if (!rqst->rq_rbuffer) {

		put_page(page);

		return -ENOMEM;

	}

	return 0;

}



static void

xprt_rdma_bc_free(struct rpc_task *task)

{

	/* No-op: ctxt and page have already been freed. */

	struct rpc_rqst *rqst = task->tk_rqstp;



	kfree(rqst->rq_rbuffer);

}



static int