Commit 23cf1ee1 authored by Chuck Lever's avatar Chuck Lever
Browse files

svcrdma: Fix leak of svc_rdma_recv_ctxt objects 



Utilize the xpo_release_rqst transport method to ensure that each
rqstp's svc_rdma_recv_ctxt object is released even when the server
cannot return a Reply for that rqstp.

Without this fix, each RPC whose Reply cannot be sent leaks one
svc_rdma_recv_ctxt. This is a 2.5KB structure, a 4KB DMA-mapped
Receive buffer, and any pages that might be part of the Reply
message.

The leak is infrequent unless the network fabric is unreliable or
Kerberos is in use, as GSS sequence window overruns, which result
in connection loss, are more common on fast transports.

Fixes: 3a88092e ("svcrdma: Preserve Receive buffer until svc_rdma_sendto")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent e28b4fc6

include/linux/sunrpc/svc_rdma.h

+1 −0
Original line number Diff line number Diff line
@@ -170,6 +170,7 @@ extern bool svc_rdma_post_recvs(struct svcxprt_rdma *rdma); 
extern void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,

				   struct svc_rdma_recv_ctxt *ctxt);

extern void svc_rdma_flush_recv_queues(struct svcxprt_rdma *rdma);

extern void svc_rdma_release_rqst(struct svc_rqst *rqstp);

extern int svc_rdma_recvfrom(struct svc_rqst *);



/* svc_rdma_rw.c */

net/sunrpc/svc_xprt.c

+0 −3
Original line number Diff line number Diff line
@@ -908,9 +908,6 @@ int svc_send(struct svc_rqst *rqstp) 
	if (!xprt)

		goto out;



	/* release the receive skb before sending the reply */

	xprt->xpt_ops->xpo_release_rqst(rqstp);



	/* calculate over-all length */

	xb = &rqstp->rq_res;

	xb->len = xb->head[0].iov_len +

net/sunrpc/svcsock.c

+4 −0
Original line number Diff line number Diff line
@@ -527,6 +527,8 @@ static int svc_udp_sendto(struct svc_rqst *rqstp) 
	unsigned int uninitialized_var(sent);

	int err;



	svc_release_udp_skb(rqstp);



	svc_set_cmsg_data(rqstp, cmh);



	err = xprt_sock_sendmsg(svsk->sk_sock, &msg, xdr, 0, 0, &sent);
@@ -1076,6 +1078,8 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) 
	unsigned int uninitialized_var(sent);

	int err;



	svc_release_skb(rqstp);



	err = xprt_sock_sendmsg(svsk->sk_sock, &msg, xdr, 0, marker, &sent);

	xdr_free_bvec(xdr);

	if (err < 0 || sent != (xdr->len + sizeof(marker)))

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c

+22 −0
Original line number Diff line number Diff line
@@ -223,6 +223,26 @@ void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma, 
		svc_rdma_recv_ctxt_destroy(rdma, ctxt);

}



/**

 * svc_rdma_release_rqst - Release transport-specific per-rqst resources

 * @rqstp: svc_rqst being released

 *

 * Ensure that the recv_ctxt is released whether or not a Reply

 * was sent. For example, the client could close the connection,

 * or svc_process could drop an RPC, before the Reply is sent.

 */

void svc_rdma_release_rqst(struct svc_rqst *rqstp)

{

	struct svc_rdma_recv_ctxt *ctxt = rqstp->rq_xprt_ctxt;

	struct svc_xprt *xprt = rqstp->rq_xprt;

	struct svcxprt_rdma *rdma =

		container_of(xprt, struct svcxprt_rdma, sc_xprt);



	rqstp->rq_xprt_ctxt = NULL;

	if (ctxt)

		svc_rdma_recv_ctxt_put(rdma, ctxt);

}



static int __svc_rdma_post_recv(struct svcxprt_rdma *rdma,

				struct svc_rdma_recv_ctxt *ctxt)

{
@@ -820,6 +840,8 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp) 
	__be32 *p;

	int ret;



	rqstp->rq_xprt_ctxt = NULL;



	spin_lock(&rdma_xprt->sc_rq_dto_lock);

	ctxt = svc_rdma_next_recv_ctxt(&rdma_xprt->sc_read_complete_q);

	if (ctxt) {

net/sunrpc/xprtrdma/svc_rdma_sendto.c

+3 −10
Original line number Diff line number Diff line
@@ -926,12 +926,7 @@ int svc_rdma_sendto(struct svc_rqst *rqstp) 
	ret = svc_rdma_send_reply_msg(rdma, sctxt, rctxt, rqstp);

	if (ret < 0)

		goto err1;

	ret = 0;



out:

	rqstp->rq_xprt_ctxt = NULL;

	svc_rdma_recv_ctxt_put(rdma, rctxt);

	return ret;

	return 0;



 err2:

	if (ret != -E2BIG && ret != -EINVAL)
@@ -940,16 +935,14 @@ out: 
	ret = svc_rdma_send_error_msg(rdma, sctxt, rqstp);

	if (ret < 0)

		goto err1;

	ret = 0;

	goto out;

	return 0;



 err1:

	svc_rdma_send_ctxt_put(rdma, sctxt);

 err0:

	trace_svcrdma_send_failed(rqstp, ret);

	set_bit(XPT_CLOSE, &xprt->xpt_flags);

	ret = -ENOTCONN;

	goto out;

	return -ENOTCONN;

}



/**

CRA Git | Maintained and supported by SUSTech CRA and CCSE