xprtrdma: Fix backchannel allocation of extra rpcrdma_reps

commit d698c4a02ee02053bbebe051322ff427a2dad56a upstream.

The backchannel code uses rpcrdma_recv_buffer_put to add new reps
to the free rep list. This also decrements rb_recv_count, which
spoofs the receive overrun logic in rpcrdma_buffer_get_rep.

Commit 9b06688bc3b9 ("xprtrdma: Fix additional uses of
spin_lock_irqsave(rb_lock)") replaced the original open-coded
list_add with a call to rpcrdma_recv_buffer_put(), but then a year
later, commit 05c974669ece ("xprtrdma: Fix receive buffer
accounting") added rep accounting to rpcrdma_recv_buffer_put.
It was an oversight to let the backchannel continue to use this
function.

The fix this, let's combine the "add to free list" logic with
rpcrdma_create_rep.

Also, do not allocate RPCRDMA_MAX_BC_REQUESTS rpcrdma_reps in
rpcrdma_buffer_create and then allocate additional rpcrdma_reps in
rpcrdma_bc_setup_reps. Allocating the extra reps during backchannel
set-up is sufficient.

Fixes: 05c974669ece ("xprtrdma: Fix receive buffer accounting")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index f66ddaf47829fb69259bdd00cb339951324bddbd..ddd70aec4d886e3bec659efaf6383e647f531f78 100644 (file)
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -84,21 +84,13 @@ static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt,
 static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
                                 unsigned int count)
 {
-       struct rpcrdma_rep *rep;
        int rc = 0;
 
        while (count--) {
-               rep = rpcrdma_create_rep(r_xprt);
-               if (IS_ERR(rep)) {
-                       pr_err("RPC:       %s: reply buffer alloc failed\n",
-                              __func__);
-                       rc = PTR_ERR(rep);
+               rc = rpcrdma_create_rep(r_xprt);
+               if (rc)
                        break;
-               }
-
-               rpcrdma_recv_buffer_put(rep);
        }
-
        return rc;
 }
 

diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index d9c2097dcff45f081cef4c6bc85f15020afa458d..b6879a1986a7a1d9d115264761452b627380d919 100644 (file)
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -911,10 +911,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt)
        return req;
 }
 
-struct rpcrdma_rep *
-rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
+/**
+ * rpcrdma_create_rep - Allocate an rpcrdma_rep object
+ * @r_xprt: controlling transport
+ *
+ * Returns 0 on success or a negative errno on failure.
+ */
+int
+ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
 {
        struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data;
+       struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
        struct rpcrdma_ia *ia = &r_xprt->rx_ia;
        struct rpcrdma_rep *rep;
        int rc;
@@ -934,12 +941,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
        rep->rr_device = ia->ri_device;
        rep->rr_rxprt = r_xprt;
        INIT_WORK(&rep->rr_work, rpcrdma_receive_worker);
-       return rep;
+
+       spin_lock(&buf->rb_lock);
+       list_add(&rep->rr_list, &buf->rb_recv_bufs);
+       spin_unlock(&buf->rb_lock);
+       return 0;
 
 out_free:
        kfree(rep);
 out:
-       return ERR_PTR(rc);
+       dprintk("RPC:       %s: reply buffer %d alloc failed\n",
+               __func__, rc);
+       return rc;
 }
 
 int
@@ -975,17 +988,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
        }
 
        INIT_LIST_HEAD(&buf->rb_recv_bufs);
-       for (i = 0; i < buf->rb_max_requests + 2; i++) {
-               struct rpcrdma_rep *rep;
-
-               rep = rpcrdma_create_rep(r_xprt);
-               if (IS_ERR(rep)) {
-                       dprintk("RPC:       %s: reply buffer %d alloc failed\n",
-                               __func__, i);
-                       rc = PTR_ERR(rep);
+       for (i = 0; i <= buf->rb_max_requests; i++) {
+               rc = rpcrdma_create_rep(r_xprt);
+               if (rc)
                        goto out;
-               }
-               list_add(&rep->rr_list, &buf->rb_recv_bufs);
        }
 
        return 0;

diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index ac7f8d4f632a9e923fdcf3fdbd8f628ad044d34b..36ec6a6026656b39b72476b1d249588721241604 100644 (file)
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -431,8 +431,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_ia *, struct rpcrdma_ep *,
  * Buffer calls - xprtrdma/verbs.c
  */
 struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *);
-struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *);
 void rpcrdma_destroy_req(struct rpcrdma_ia *, struct rpcrdma_req *);
+int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt);
 int rpcrdma_buffer_create(struct rpcrdma_xprt *);
 void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);