> -----Original Message----- > From: gregkh@xxxxxxxxxxxxxxxxxxx [mailto:gregkh@xxxxxxxxxxxxxxxxxxx] > Sent: Saturday, October 17, 2015 7:27 PM > To: swise@xxxxxxxxxxxxxxxxxxxxx; bfields@xxxxxxxxxx; chuck.lever@xxxxxxxxxx > Cc: stable@xxxxxxxxxxxxxxx > Subject: FAILED: patch "[PATCH] svcrdma: handle rdma read with a non-zero initial page offset" failed to apply to 4.1-stable tree > > > The patch below does not apply to the 4.1-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to <stable@xxxxxxxxxxxxxxx>. > > thanks, > > greg k-h > Hey Greg, I submitted the backport patch to linux-stable. Thanks, Steve. > ------------------ original commit in Linus's tree ------------------ > > >From c91aed9896946721bb30705ea2904edb3725dd61 Mon Sep 17 00:00:00 2001 > From: Steve Wise <swise@xxxxxxxxxxxxxxxxxxxxx> > Date: Mon, 28 Sep 2015 16:46:06 -0500 > Subject: [PATCH] svcrdma: handle rdma read with a non-zero initial page offset > > The server rdma_read_chunk_lcl() and rdma_read_chunk_frmr() functions > were not taking into account the initial page_offset when determining > the rdma read length. This resulted in a read who's starting address > and length exceeded the base/bounds of the frmr. > > The server gets an async error from the rdma device and kills the > connection, and the client then reconnects and resends. This repeats > indefinitely, and the application hangs. > > Most work loads don't tickle this bug apparently, but one test hit it > every time: building the linux kernel on a 16 core node with 'make -j > 16 O=/mnt/0' where /mnt/0 is a ramdisk mounted via NFSRDMA. > > This bug seems to only be tripped with devices having small fastreg page > list depths. I didn't see it with mlx4, for instance. > > Fixes: 0bf4828983df ('svcrdma: refactor marshalling logic') > Signed-off-by: Steve Wise <swise@xxxxxxxxxxxxxxxxxxxxx> > Tested-by: Chuck Lever <chuck.lever@xxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxx> > > diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > index cb5174284074..5f6ca47092b0 100644 > --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > @@ -136,7 +136,8 @@ int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt, > ctxt->direction = DMA_FROM_DEVICE; > ctxt->read_hdr = head; > pages_needed = min_t(int, pages_needed, xprt->sc_max_sge_rd); > - read = min_t(int, pages_needed << PAGE_SHIFT, rs_length); > + read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset, > + rs_length); > > for (pno = 0; pno < pages_needed; pno++) { > int len = min_t(int, rs_length, PAGE_SIZE - pg_off); > @@ -235,7 +236,8 @@ int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt, > ctxt->direction = DMA_FROM_DEVICE; > ctxt->frmr = frmr; > pages_needed = min_t(int, pages_needed, xprt->sc_frmr_pg_list_len); > - read = min_t(int, pages_needed << PAGE_SHIFT, rs_length); > + read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset, > + rs_length); > > frmr->kva = page_address(rqstp->rq_arg.pages[pg_no]); > frmr->direction = DMA_FROM_DEVICE; -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html