lkml.org 
[lkml]   [2020]   [Sep]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 138/166] scsi: libfc: Handling of extra kref
    Date
    From: Javed Hasan <jhasan@marvell.com>

    [ Upstream commit 71f2bf85e90d938d4a9ef9dd9bfa8d9b0b6a03f7 ]

    Handling of extra kref which is done by lookup table in case rdata is
    already present in list.

    This issue was leading to memory leak. Trace from KMEMLEAK tool:

    unreferenced object 0xffff8888259e8780 (size 512):
    comm "kworker/2:1", pid 182614, jiffies 4433237386 (age 113021.971s)
    hex dump (first 32 bytes):
    58 0a ec cf 83 88 ff ff 00 00 00 00 00 00 00 00
    01 00 00 00 08 00 00 00 13 7d f0 1e 0e 00 00 10
    backtrace:
    [<000000006b25760f>] fc_rport_recv_req+0x3c6/0x18f0 [libfc]
    [<00000000f208d994>] fc_lport_recv_els_req+0x120/0x8a0 [libfc]
    [<00000000a9c437b8>] fc_lport_recv+0xb9/0x130 [libfc]
    [<00000000ad5be37b>] qedf_ll2_process_skb+0x73d/0xad0 [qedf]
    [<00000000e0eb6893>] process_one_work+0x382/0x6c0
    [<000000002dfd9e21>] worker_thread+0x57/0x5c0
    [<00000000b648204f>] kthread+0x1a0/0x1c0
    [<0000000072f5ab20>] ret_from_fork+0x35/0x40
    [<000000001d5c05d8>] 0xffffffffffffffff

    Below is the log sequence which leads to memory leak. Here we get the
    nested "Received PLOGI request" for same port and this request leads to
    call the fc_rport_create() twice for the same rport.

    kernel: host1: rport fffce5: Received PLOGI request
    kernel: host1: rport fffce5: Received PLOGI in INIT state
    kernel: host1: rport fffce5: Port is Ready
    kernel: host1: rport fffce5: Received PRLI request while in state Ready
    kernel: host1: rport fffce5: PRLI rspp type 8 active 1 passive 0
    kernel: host1: rport fffce5: Received LOGO request while in state Ready
    kernel: host1: rport fffce5: Delete port
    kernel: host1: rport fffce5: Received PLOGI request
    kernel: host1: rport fffce5: Received PLOGI in state Delete - send busy

    Link: https://lore.kernel.org/r/20200622101212.3922-2-jhasan@marvell.com
    Reviewed-by: Girish Basrur <gbasrur@marvell.com>
    Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
    Reviewed-by: Shyam Sundar <ssundar@marvell.com>
    Signed-off-by: Javed Hasan <jhasan@marvell.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/libfc/fc_rport.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
    index 0e964ce75406b..a9137f64befa0 100644
    --- a/drivers/scsi/libfc/fc_rport.c
    +++ b/drivers/scsi/libfc/fc_rport.c
    @@ -145,8 +145,10 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
    size_t rport_priv_size = sizeof(*rdata);

    rdata = fc_rport_lookup(lport, port_id);
    - if (rdata)
    + if (rdata) {
    + kref_put(&rdata->kref, fc_rport_destroy);
    return rdata;
    + }

    if (lport->rport_priv_size > 0)
    rport_priv_size = lport->rport_priv_size;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-09-29 14:37    [W:4.188 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site