Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fc83f47 authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

xprtrdma: Fix panic in rpcrdma_register_frmr_external() 



seg1->mr_nsegs is not yet initialized when it is used to unmap
segments during an error exit. Use the same unmapping logic for
all error exits.

"if (frmr_wr.wr.fast_reg.length < len) {" used to be a BUG_ON check.
The broken code will never be executed under normal operation.

Fixes: c977dea2 (xprtrdma: Remove BUG_ON() call sites)
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Tested-by: default avatarSteve Wise <swise@opengridcomputing.com>
Tested-by: default avatarShirley Ma <shirley.ma@oracle.com>
Tested-by: default avatarDevesh Sharma <devesh.sharma@emulex.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent bf858ab0

net/sunrpc/xprtrdma/verbs.c

+7 −5
Original line number Diff line number Diff line
@@ -1548,9 +1548,8 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, 
	frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;

	frmr_wr.wr.fast_reg.length = page_no << PAGE_SHIFT;

	if (frmr_wr.wr.fast_reg.length < len) {

		while (seg1->mr_nsegs--)

			rpcrdma_unmap_one(ia, seg++);

		return -EIO;

		rc = -EIO;

		goto out_err;

	}



	/* Bump the key */
@@ -1568,8 +1567,7 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, 
	if (rc) {

		dprintk("RPC:       %s: failed ib_post_send for register,"

			" status %i\n", __func__, rc);

		while (i--)

			rpcrdma_unmap_one(ia, --seg);

		goto out_err;

	} else {

		seg1->mr_rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;

		seg1->mr_base = seg1->mr_dma + pageoff;
@@ -1577,6 +1575,10 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, 
		seg1->mr_len = len;

	}

	*nsegs = i;

	return 0;

out_err:

	while (i--)

		rpcrdma_unmap_one(ia, --seg);

	return rc;

}