1. 29 Sep, 2015 10 commits
  2. 22 Sep, 2015 16 commits
  3. 27 Aug, 2015 1 commit
  4. 26 Aug, 2015 5 commits
  5. 25 Aug, 2015 8 commits
    • santosh.shilimkar@oracle.com's avatar
      RDS: remove superfluous from rds_ib_alloc_fmr() · 27241214
      santosh.shilimkar@oracle.com authored
      
      
      Memory allocated for 'ibmr' uses kzalloc_node() which already
      initialises the memory to zero. There is no need to do
      memset() 0 on that memory.
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      27241214
    • santosh.shilimkar@oracle.com's avatar
      RDS: flush the FMR pool less often · ef5217a6
      santosh.shilimkar@oracle.com authored
      
      
      FMR flush is an expensive and time consuming operation. Reduce the
      frequency of FMR pool flush by 50% so that more FMR work gets accumulated
      for more efficient flushing.
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef5217a6
    • santosh.shilimkar@oracle.com's avatar
      RDS: push FMR pool flush work to its own worker · ad1d7dc0
      santosh.shilimkar@oracle.com authored
      
      
      RDS FMR flush operation and also it races with connect/reconect
      which happes a lot with RDS. FMR flush being on common rds_wq aggrevates
      the problem. Lets push RDS FMR pool flush work to its own worker.
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ad1d7dc0
    • Wengang Wang's avatar
      RDS: fix fmr pool dirty_count · 6116c203
      Wengang Wang authored
      
      
      In rds_ib_flush_mr_pool(), dirty_count accounts the clean ones
      which is wrong. This can lead to a negative dirty count value.
      
      Lets fix it.
      Signed-off-by: default avatarWengang Wang <wen.gang.wang@oracle.com>
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6116c203
    • santosh.shilimkar@oracle.com's avatar
      RDS: Fix rds MR reference count in rds_rdma_unuse() · 3f6b3143
      santosh.shilimkar@oracle.com authored
      
      
      rds_rdma_unuse() drops the mr reference count which it hasn't
      taken. Correct way of removing mr is to remove mr from the tree
      and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
      its reference count. Whichever thread holds last reference will free
      the mr via rds_mr_put()
      
      This bug was triggering weird null pointer crashes. One if the trace
      for it is captured below.
      
      BUG: unable to handle kernel NULL pointer dereference at
      0000000000000104
      IP: [<ffffffffa0899471>] rds_ib_free_mr+0x31/0x130 [rds_rdma]
      PGD 4366fa067 PUD 4366f9067 PMD 0
      Oops: 0000 [#1] SMP
      
      [...]
      
      task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
      RIP: 0010:[<ffffffffa0899471>]  [<ffffffffa0899471>]
      rds_ib_free_mr+0x31/0x130 [rds_rdma]
      RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
      RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
      RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
      RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
      R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
      R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
      Stack:
       ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
       ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
       0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
      Call Trace:
       <IRQ>
       [<ffffffffa087a38b>] rds_destroy_mr+0x8b/0xa0 [rds]
       [<ffffffffa087a3b6>] __rds_put_mr_final+0x16/0x30 [rds]
       [<ffffffffa087a492>] rds_rdma_unuse+0xc2/0x120 [rds]
       [<ffffffffa08766d3>] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
       [<ffffffffa0876782>] rds_recv_incoming+0x92/0x200 [rds]
       [<ffffffffa0895269>] rds_ib_process_recv+0x259/0x320 [rds_rdma]
       [<ffffffffa08962a8>] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
       [<ffffffff810dcd78>] ? __remove_hrtimer+0x58/0x90
       [<ffffffff810799e1>] tasklet_action+0xb1/0xc0
       [<ffffffff81079b52>] __do_softirq+0xe2/0x290
       [<ffffffff81079df6>] irq_exit+0xa6/0xb0
       [<ffffffff81613915>] do_IRQ+0x65/0xf0
       [<ffffffff816118ab>] common_interrupt+0x6b/0x6b
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f6b3143
    • santosh.shilimkar@oracle.com's avatar
      RDS: fix the dangling reference to rds_ib_incoming_slab · ba54d3ce
      santosh.shilimkar@oracle.com authored
      
      
      On rds_ib_frag_slab allocation failure, ensure rds_ib_incoming_slab
      is not pointing to the detsroyed memory.
      Signed-off-by: default avatarSantosh Shilimkar <ssantosh@kernel.org>
      Signed-off-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ba54d3ce
    • David S. Miller's avatar
      rds: Fix improper gfp_t usage. · b01d04aa
      David S. Miller authored
      
      
      >> net/rds/ib_recv.c:382:28: sparse: incorrect type in initializer (different base types)
         net/rds/ib_recv.c:382:28:    expected int [signed] can_wait
         net/rds/ib_recv.c:382:28:    got restricted gfp_t
         net/rds/ib_recv.c:828:23: sparse: cast to restricted __le64
      Reported-by: default avatarkbuild test robot <fengguang.wu@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b01d04aa
    • WANG Cong's avatar
      route: fix a use-after-free · e252b3d1
      WANG Cong authored
      This patch fixes the following crash:
      
       general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
       CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
       task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000
       RIP: 0010:[<ffffffff8182f91b>]  [<ffffffff8182f91b>] dst_destroy+0xa6/0xef
       RSP: 0018:ffff880107603e38  EFLAGS: 00010202
       RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0
       RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b
       RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001
       R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000
       R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f
       FS:  0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
       CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0
       Stack:
        ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000
        ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e
        ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280
       Call Trace:
        <IRQ>
        [<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d
        [<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb
        [<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb
        [<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb
        [<ffffffff8107e11b>] __do_softirq+0x178/0x39f
        [<ffffffff8107e52e>] irq_exit+0x41/0x95
        [<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40
        [<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80
        <EOI>
        [<ffffffff8100b968>] ? default_idle+0x21/0x32
        [<ffffffff8100b966>] ? default_idle+0x1f/0x32
        [<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11
        [<ffffffff810b0bc7>] default_idle_call+0x1f/0x21
        [<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273
        [<ffffffff8102fe67>] start_secondary+0x135/0x156
      
      dst is freed right before lwtstate_put(), this is not correct...
      
      Fixes: 61adedf3
      
       ("route: move lwtunnel state to dst_entry")
      Acked-by: default avatarJiri Benc <jbenc@redhat.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e252b3d1