Patch "xprtrdma: Remove FMRs from the unmap list after unmapping" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

xprtrdma: Remove FMRs from the unmap list after unmapping

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xprtrdma-remove-fmrs-from-the-unmap-list-after-unmapping.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Chuck Lever <[email protected]>
Date: Wed, 29 Jun 2016 13:52:12 -0400
Subject: xprtrdma: Remove FMRs from the unmap list after unmapping

From: Chuck Lever <[email protected]>

commit 38f1932e60ba249660bbae585f61ef2dee3313a4 upstream.

ib_unmap_fmr() takes a list of FMRs to unmap. However, it does not remove the FMRs from this list as it processes them. Other ib_unmap_fmr() call sites are careful to remove FMRs from the list after ib_unmap_fmr() returns.

Since commit 7c7a5390dc6c8 ("xprtrdma: Add ro_unmap_sync method for FMR") fmr_op_unmap_sync passes more than one FMR to ib_unmap_fmr(), but it didn't bother to remove the FMRs from that list once the call was complete.

I've noticed some instability that could be related to list tangling by the new fmr_op_unmap_sync() logic. In an abundance of caution, add some defensive logic to clean up properly after ib_unmap_fmr().

---
 net/sunrpc/xprtrdma/fmr_ops.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

@@ -63,9 +63,12 @@ static int
 __fmr_unmap(struct rpcrdma_mw *mw)
 {
 	LIST_HEAD(l);
+	int rc;
 
 	list_add(&mw->fmr.fmr->list, &l);
-	return ib_unmap_fmr(&l);
+	rc = ib_unmap_fmr(&l);
+	list_del_init(&mw->fmr.fmr->list);
+	return rc;
 }
 
 /* Deferred reset of a single FMR. Generate a fresh rkey by

@@ -267,7 +270,7 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r
 		seg = &req->rl_segments[i];
 		mw = seg->rl_mw;
 
-		list_add(&mw->fmr.fmr->list, &unmap_list);
+		list_add_tail(&mw->fmr.fmr->list, &unmap_list);
 
 		i += seg->mr_nsegs;
 	}

@@ -280,7 +283,9 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r
 	 */
 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
 		seg = &req->rl_segments[i];
+		mw = seg->rl_mw;
 
+		list_del_init(&mw->fmr.fmr->list);
 		__fmr_dma_unmap(r_xprt, seg);
 		rpcrdma_put_mw(r_xprt, seg->rl_mw);
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/xprtrdma-remove-fmrs-from-the-unmap-list-after-unmapping.patch queue-4.7/svc-avoid-garbage-replies-when-pc_func-returns-rpc_drop_reply.patch queue-4.7/nfs-don-t-drop-cb-requests-with-invalid-principals.patch