From: Chuck Lever <chuck.lever@oracle.com>
Date: Fri, 8 Jan 2016 21:11:31 +0000 (-0700)
Subject: xprtrdma: xprt_rdma_free() must not release backchannel reqs
X-Git-Tag: v4.1.12-92~206^2
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=38f83768501dfe2300ab4ef9010d52ab0bad8bae;p=users%2Fjedix%2Flinux-maple.git

xprtrdma: xprt_rdma_free() must not release backchannel reqs

Orabug: 22365704

Preserve any rpcrdma_req that is attached to rpc_rqst's allocated
for the backchannel. Otherwise, after all the pre-allocated
backchannel req's are consumed, incoming backward calls start
writing on freed memory.

Somehow this hunk got lost.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Acked-by: John Sobecki <john.sobecki@oracle.com>
Tested-by: Dai Ngo <dai.ngo@oracle.com>
---

diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 54f23b1be986..dda14e8392de 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -578,6 +578,9 @@ xprt_rdma_free(void *buffer)
 
 	rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]);
 	req = rb->rg_owner;
+	if (req->rl_backchannel)
+		return;
+
 	r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
 
 	dprintk("RPC:       %s: called on 0x%p\n", __func__, req->rl_reply);