Messages in this thread | | | Subject | Re: [PATCH] nvme-rdma: handle nvme completion data length | From | Chao Leng <> | Date | Thu, 22 Oct 2020 17:55:01 +0800 |
| |
On 2020/10/22 16:38, zhenwei pi wrote: > Hit a kernel warning: > refcount_t: underflow; use-after-free. > WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 > > RIP: 0010:refcount_warn_saturate+0xd9/0xe0 > Call Trace: > <IRQ> > nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma] > __ib_process_cq+0x76/0x150 [ib_core] > ... > > The reason is that a zero bytes message received from target, and the > host side continues to process without length checking, then the > previous CQE is processed twice. > > Handle data length, ignore zero bytes message, and try to recovery for > corrupted CQE case. > > Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> > --- > drivers/nvme/host/rdma.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c > index 9e378d0a0c01..9f5112040d43 100644 > --- a/drivers/nvme/host/rdma.c > +++ b/drivers/nvme/host/rdma.c > @@ -1767,6 +1767,17 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) > return; > } > > + if (unlikely(!wc->byte_len)) { > + /* zero bytes message could be ignored */ > + return; > + } else if (unlikely(wc->byte_len < len)) { > + /* Corrupted completion, try to recovry */ > + dev_err(queue->ctrl->ctrl.device, > + "Unexpected nvme completion length(%d)\n", wc->byte_len); > + nvme_rdma_error_recovery(queue->ctrl); > + return; > + } !wc->byte_len and wc->byte_len < len may be the same type of anomaly. Why do different error handling? In which scenario zero bytes message received from target? fault inject test or normal test/run? > + > ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE); > /* > * AEN requests are special as they don't time out and can >
| |