diff options
| author |   Chuck Lever <chuck.lever@oracle.com> | 2020-04-19 20:03:05 -0400 |
|---|---|---|
| committer |   Anna Schumaker <Anna.Schumaker@Netapp.com> | 2020-04-20 10:44:01 -0400 |
| commit | bdb2ce82818577ba6e57b7d68b698b8d17329281 (patch) | |
| tree | 951e3fdca0873b24e24553fa297a6f49d2722f46 /net/sunrpc/xprtrdma/verbs.c | |
| parent | xprtrdma: Restore wake-up-all to rpcrdma_cm_event_handler() (diff) | |
| download | linux-dev-bdb2ce82818577ba6e57b7d68b698b8d17329281.tar.xz linux-dev-bdb2ce82818577ba6e57b7d68b698b8d17329281.zip | |
xprtrdma: Fix trace point use-after-free race
It's not safe to use resources pointed to by the @send_wr of
ib_post_send() _after_ that function returns. Those resources are
typically freed by the Send completion handler, which can run before
ib_post_send() returns.
Thus the trace points currently around ib_post_send() in the
client's RPC/RDMA transport are a hazard, even when they are
disabled. Rearrange them so that they touch the Work Request only
_before_ ib_post_send() is invoked.
Fixes: ab03eff58eb5 ("xprtrdma: Add trace points in RPC Call transmit paths")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Diffstat (limited to 'net/sunrpc/xprtrdma/verbs.c')
| -rw-r--r-- | net/sunrpc/xprtrdma/verbs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c index 29ae982d69cf..05c4d3a9cda2 100644 --- a/net/sunrpc/xprtrdma/verbs.c +++ b/net/sunrpc/xprtrdma/verbs.c @@ -1356,8 +1356,8 @@ int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req) --ep->re_send_count; } + trace_xprtrdma_post_send(req); rc = frwr_send(r_xprt, req); - trace_xprtrdma_post_send(req, rc); if (rc) return -ENOTCONN; return 0; |