Commit eb8d3a2c authored by NeilBrown's avatar NeilBrown Committed by Chuck Lever
Browse files

SUNRPC: double free xprt_ctxt while still in use 



When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out
of the svc_rqst into the svc_deferred_req.
When the deferred request is revisited, the pointer is copied into
the new svc_rqst - and also remains in the svc_deferred_req.

In the (rare?) case that the request is deferred a second time, the old
svc_deferred_req is reused - it still has all the correct content.
However in that case the rq_xprt_ctxt pointer is NOT cleared so that
when xpo_release_xprt is called, the ctxt is freed (UDP) or possible
added to a free list (RDMA).
When the deferred request is revisited for a second time, it will
reference this ctxt which may be invalid, and the free the object a
second time which is likely to oops.

So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that
the value is now stored in the svc_deferred_req.

Fixes: 773f91b2 ("SUNRPC: Fix NFSD's request deferral on RDMA transports")
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent 319050d4

net/sunrpc/svc_xprt.c

+2 −1
Original line number Diff line number Diff line
@@ -1223,13 +1223,14 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req) 
		dr->daddr = rqstp->rq_daddr;

		dr->argslen = rqstp->rq_arg.len >> 2;

		dr->xprt_ctxt = rqstp->rq_xprt_ctxt;

		rqstp->rq_xprt_ctxt = NULL;



		/* back up head to the start of the buffer and copy */

		skip = rqstp->rq_arg.len - rqstp->rq_arg.head[0].iov_len;

		memcpy(dr->args, rqstp->rq_arg.head[0].iov_base - skip,

		       dr->argslen << 2);

	}

	WARN_ON_ONCE(rqstp->rq_xprt_ctxt != dr->xprt_ctxt);

	rqstp->rq_xprt_ctxt = NULL;

	trace_svc_defer(rqstp);

	svc_xprt_get(rqstp->rq_xprt);

	dr->xprt = rqstp->rq_xprt;