Commit bdb2ce82 authored by Chuck Lever's avatar Chuck Lever Committed by Anna Schumaker
Browse files

xprtrdma: Fix trace point use-after-free race 



It's not safe to use resources pointed to by the @send_wr of
ib_post_send() _after_ that function returns. Those resources are
typically freed by the Send completion handler, which can run before
ib_post_send() returns.

Thus the trace points currently around ib_post_send() in the
client's RPC/RDMA transport are a hazard, even when they are
disabled. Rearrange them so that they touch the Work Request only
_before_ ib_post_send() is invoked.

Fixes: ab03eff5 ("xprtrdma: Add trace points in RPC Call transmit paths")
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 58bd6656

include/trace/events/rpcrdma.h

+4 −8
Original line number Diff line number Diff line
@@ -692,11 +692,10 @@ TRACE_EVENT(xprtrdma_prepsend_failed, 


TRACE_EVENT(xprtrdma_post_send,

	TP_PROTO(

		const struct rpcrdma_req *req,

		int status

		const struct rpcrdma_req *req

	),



	TP_ARGS(req, status),

	TP_ARGS(req),



	TP_STRUCT__entry(

		__field(const void *, req)
@@ -705,7 +704,6 @@ TRACE_EVENT(xprtrdma_post_send, 
		__field(unsigned int, client_id)

		__field(int, num_sge)

		__field(int, signaled)

		__field(int, status)

	),



	TP_fast_assign(
@@ -718,15 +716,13 @@ TRACE_EVENT(xprtrdma_post_send, 
		__entry->sc = req->rl_sendctx;

		__entry->num_sge = req->rl_wr.num_sge;

		__entry->signaled = req->rl_wr.send_flags & IB_SEND_SIGNALED;

		__entry->status = status;

	),



	TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %sstatus=%d",

	TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %s",

		__entry->task_id, __entry->client_id,

		__entry->req, __entry->sc, __entry->num_sge,

		(__entry->num_sge == 1 ? "" : "s"),

		(__entry->signaled ? "signaled " : ""),

		__entry->status

		(__entry->signaled ? "signaled" : "")

	)

);

net/sunrpc/xprtrdma/verbs.c

+1 −1
Original line number Diff line number Diff line
@@ -1356,8 +1356,8 @@ int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req) 
		--ep->re_send_count;

	}



	trace_xprtrdma_post_send(req);

	rc = frwr_send(r_xprt, req);

	trace_xprtrdma_post_send(req, rc);

	if (rc)

		return -ENOTCONN;

	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE