svcrdma: Fix leak of svc_rdma_recv_ctxt objects

commit 23cf1ee1f1869966b75518c59b5cbda4c6c92450 upstream.

Utilize the xpo_release_rqst transport method to ensure that each
rqstp's svc_rdma_recv_ctxt object is released even when the server
cannot return a Reply for that rqstp.

Without this fix, each RPC whose Reply cannot be sent leaks one
svc_rdma_recv_ctxt. This is a 2.5KB structure, a 4KB DMA-mapped
Receive buffer, and any pages that might be part of the Reply
message.

The leak is infrequent unless the network fabric is unreliable or
Kerberos is in use, as GSS sequence window overruns, which result
in connection loss, are more common on fast transports.

Fixes: 3a88092ee319 ("svcrdma: Preserve Receive buffer until svc_rdma_sendto")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
index 40f65888dd3887ee0f9bc9c083cce61209acff2e..fddad9f5b390971f061af14c252554346bff4404 100644 (file)
--- a/include/linux/sunrpc/svc_rdma.h
+++ b/include/linux/sunrpc/svc_rdma.h
@@ -162,6 +162,7 @@ extern bool svc_rdma_post_recvs(struct svcxprt_rdma *rdma);
 extern void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,
                                   struct svc_rdma_recv_ctxt *ctxt);
 extern void svc_rdma_flush_recv_queues(struct svcxprt_rdma *rdma);
+extern void svc_rdma_release_rqst(struct svc_rqst *rqstp);
 extern int svc_rdma_recvfrom(struct svc_rqst *);
 
 /* svc_rdma_rw.c */

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 2985577448184f2a8fb80e4488ea6e5f3c435927..dc74519286be5a0af24bc14178403077497ea279 100644 (file)
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -897,9 +897,6 @@ int svc_send(struct svc_rqst *rqstp)
        if (!xprt)
                goto out;
 
-       /* release the receive skb before sending the reply */
-       xprt->xpt_ops->xpo_release_rqst(rqstp);
-
        /* calculate over-all length */
        xb = &rqstp->rq_res;
        xb->len = xb->head[0].iov_len +

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 2934dd7117153f5c4ba87b17be0e3a42d0c8517b..4260924ad9dba2db19725b5a625744839b4ea7ca 100644 (file)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -605,6 +605,8 @@ svc_udp_sendto(struct svc_rqst *rqstp)
 {
        int             error;
 
+       svc_release_udp_skb(rqstp);
+
        error = svc_sendto(rqstp, &rqstp->rq_res);
        if (error == -ECONNREFUSED)
                /* ICMP error on earlier request. */
@@ -1137,6 +1139,8 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
        int sent;
        __be32 reclen;
 
+       svc_release_skb(rqstp);
+
        /* Set up the first element of the reply kvec.
         * Any other kvecs that may be in use have been taken
         * care of by the server implementation itself.

diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 96bccd39846949c2f7a49643581192b948d278d0..b8ee91ffedda85315594ccd8fc84436ef285f526 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -222,6 +222,26 @@ void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,
                svc_rdma_recv_ctxt_destroy(rdma, ctxt);
 }
 
+/**
+ * svc_rdma_release_rqst - Release transport-specific per-rqst resources
+ * @rqstp: svc_rqst being released
+ *
+ * Ensure that the recv_ctxt is released whether or not a Reply
+ * was sent. For example, the client could close the connection,
+ * or svc_process could drop an RPC, before the Reply is sent.
+ */
+void svc_rdma_release_rqst(struct svc_rqst *rqstp)
+{
+       struct svc_rdma_recv_ctxt *ctxt = rqstp->rq_xprt_ctxt;
+       struct svc_xprt *xprt = rqstp->rq_xprt;
+       struct svcxprt_rdma *rdma =
+               container_of(xprt, struct svcxprt_rdma, sc_xprt);
+
+       rqstp->rq_xprt_ctxt = NULL;
+       if (ctxt)
+               svc_rdma_recv_ctxt_put(rdma, ctxt);
+}
+
 static int __svc_rdma_post_recv(struct svcxprt_rdma *rdma,
                                struct svc_rdma_recv_ctxt *ctxt)
 {
@@ -756,6 +776,8 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        __be32 *p;
        int ret;
 
+       rqstp->rq_xprt_ctxt = NULL;
+
        spin_lock(&rdma_xprt->sc_rq_dto_lock);
        ctxt = svc_rdma_next_recv_ctxt(&rdma_xprt->sc_read_complete_q);
        if (ctxt) {

diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 612770aaf729b5a8c79a81f2678dd74a15f546bc..9f234d1f3b3dd89e5570f66b2c1a4b19b367e5df 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -877,12 +877,7 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
                                      wr_lst, rp_ch);
        if (ret < 0)
                goto err1;
-       ret = 0;
-
-out:
-       rqstp->rq_xprt_ctxt = NULL;
-       svc_rdma_recv_ctxt_put(rdma, rctxt);
-       return ret;
+       return 0;
 
  err2:
        if (ret != -E2BIG && ret != -EINVAL)
@@ -891,14 +886,12 @@ out:
        ret = svc_rdma_send_error_msg(rdma, sctxt, rqstp);
        if (ret < 0)
                goto err1;
-       ret = 0;
-       goto out;
+       return 0;
 
  err1:
        svc_rdma_send_ctxt_put(rdma, sctxt);
  err0:
        trace_svcrdma_send_failed(rqstp, ret);
        set_bit(XPT_CLOSE, &xprt->xpt_flags);
-       ret = -ENOTCONN;
-       goto out;
+       return -ENOTCONN;
 }

diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 145a3615c319366fbcc9815f76d59f4e271dc6ff..889220f11a7033864a3f23162b1f4b6652ee25ef 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -71,7 +71,6 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
                                        struct sockaddr *sa, int salen,
                                        int flags);
 static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt);
-static void svc_rdma_release_rqst(struct svc_rqst *);
 static void svc_rdma_detach(struct svc_xprt *xprt);
 static void svc_rdma_free(struct svc_xprt *xprt);
 static int svc_rdma_has_wspace(struct svc_xprt *xprt);
@@ -558,10 +557,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        return NULL;
 }
 
-static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
-{
-}
-
 /*
  * When connected, an svc_xprt has at least two references:
  *