xprtrdma: xprt_rdma_free() must not release backchannel reqs

Orabug: 22365704

Preserve any rpcrdma_req that is attached to rpc_rqst's allocated
for the backchannel. Otherwise, after all the pre-allocated
backchannel req's are consumed, incoming backward calls start
writing on freed memory.

Somehow this hunk got lost.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Acked-by: John Sobecki <john.sobecki@oracle.com>
Tested-by: Dai Ngo <dai.ngo@oracle.com>

diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 54f23b1be98617d5c29fb482a221ad6ed1391876..dda14e8392de33f8a60a6221e95276fb8f82277f 100644 (file)
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -578,6 +578,9 @@ xprt_rdma_free(void *buffer)
 
        rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]);
        req = rb->rg_owner;
+       if (req->rl_backchannel)
+               return;
+
        r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
 
        dprintk("RPC:       %s: called on 0x%p\n", __func__, req->rl_reply);