net/rds: ib: Release correct number of frags

Commit c682e8474bd4 ("net/rds: reduce memory footprint during
ib_post_recv in IB transport") introduces an SG list instead of a
single contiguously fragment. When rebuilding the caches, it attempts
to release the number of fragments used by the new connection,
independent of the actual number of fragments used by the cache. This
leads to a kernel crash. Instead, release the correct number of
fragments.

Orabug: 27924161

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 69c516508bcaefb38a9b7a45797a5f07b57b710c..1c20969e040790712b0e8f49993509cd694e612b 100644 (file)
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -207,13 +207,16 @@ void rds_ib_recv_free_caches(struct rds_ib_connection *ic)
        free_percpu(ic->i_cache_frags.percpu);
 
        list_for_each_entry_safe(frag, frag_tmp, &list, f_cache_entry) {
+               int cache_frag_pages = ceil(ic->i_frag_cache_sz, PAGE_SIZE);
+
                list_del(&frag->f_cache_entry);
                WARN_ON(!list_empty(&frag->f_item));
-               rds_ib_recv_free_frag(frag, ic->i_frag_pages);
-               atomic_sub(ic->i_frag_pages, &rds_ib_allocation);
+               rds_ib_recv_free_frag(frag, cache_frag_pages);
+               atomic_sub(cache_frag_pages, &rds_ib_allocation);
                kmem_cache_free(rds_ib_frag_slab, frag);
-               atomic_sub(ic->i_frag_sz / 1024, &ic->i_cache_allocs);
-               rds_ib_stats_add(s_ib_recv_removed_from_cache, ic->i_frag_sz);
+               atomic_sub(ic->i_frag_cache_sz / 1024, &ic->i_cache_allocs);
+               rds_ib_stats_add(s_ib_recv_removed_from_cache, ic->i_frag_cache_sz);
+
        }
 }