svcrdma: backchannel cannot share a page for send and rcv buffers

The underlying transport releases the page pointed to by rq_buffer
during xprt_rdma_bc_send_request. When the backchannel reply arrives,
rq_rbuffer then points to freed memory.

Fixes: 48888135f71c ('SUNRPC: Separate buffer pointers for RPC ...')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index fc4535ead7c2293490d91815596412b784d1c9e0..20027f8de129e61faba9037d552eb826ecc34ae4 100644 (file)
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -177,19 +177,26 @@ xprt_rdma_bc_allocate(struct rpc_task *task)
                return -EINVAL;
        }
 
+       /* svc_rdma_sendto releases this page */
        page = alloc_page(RPCRDMA_DEF_GFP);
        if (!page)
                return -ENOMEM;
-
        rqst->rq_buffer = page_address(page);
-       rqst->rq_rbuffer = (char *)rqst->rq_buffer + rqst->rq_callsize;
+
+       rqst->rq_rbuffer = kmalloc(rqst->rq_rcvsize, RPCRDMA_DEF_GFP);
+       if (!rqst->rq_rbuffer) {
+               put_page(page);
+               return -ENOMEM;
+       }
        return 0;
 }
 
 static void
 xprt_rdma_bc_free(struct rpc_task *task)
 {
-       /* No-op: ctxt and page have already been freed. */
+       struct rpc_rqst *rqst = task->tk_rqstp;
+
+       kfree(rqst->rq_rbuffer);
 }
 
 static int