Skip to main content

Browse the archive

Revision 4fabb59449aa44a585b3603ffdadd4c5f4d0c033 authored by Wengang Wang on 06 July 2015, 06:35:11 UTC, committed by Doug Ledford on 14 July 2015, 17:20:11 UTC 
rds: rds_ib_device.refcount overflow
 
Fixes: 3e0249f9c05c ("RDS/IB: add refcount tracking to struct rds_ib_device")

There lacks a dropping on rds_ib_device.refcount in case rds_ib_alloc_fmr
failed(mr pool running out). this lead to the refcount overflow.

A complain in line 117(see following) is seen. From vmcore:
s_ib_rdma_mr_pool_depleted is 2147485544 and rds_ibdev->refcount is -2147475448.
That is the evidence the mr pool is used up. so rds_ib_alloc_fmr is very likely
to return ERR_PTR(-EAGAIN).

115 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
116 {
117         BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
118         if (atomic_dec_and_test(&rds_ibdev->refcount))
119                 queue_work(rds_wq, &rds_ibdev->free_work);
120 }

fix is to drop refcount when rds_ib_alloc_fmr failed.

Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
1 parent 0a69127
Raw File
decodecode 
#!/bin/sh
# Disassemble the Code: line in Linux oopses
# usage: decodecode < oops.file
#
# options: set env. variable AFLAGS=options to pass options to "as";
# e.g., to decode an i386 oops on an x86_64 system, use:
# AFLAGS=--32 decodecode < 386.oops

cleanup() {
	rm -f $T $T.s $T.o $T.oo $T.aa $T.dis
	exit 1
}

die() {
	echo "$@"
	exit 1
}

trap cleanup EXIT

T=`mktemp` || die "cannot create temp file"
code=

while read i ; do

case "$i" in
*Code:*)
	code=$i
	;;
esac

done

if [ -z "$code" ]; then
	rm $T
	exit
fi

echo $code
code=`echo $code | sed -e 's/.*Code: //'`

width=`expr index "$code" ' '`
width=$((($width-1)/2))
case $width in
1) type=byte ;;
2) type=2byte ;;
4) type=4byte ;;
esac

disas() {
	${CROSS_COMPILE}as $AFLAGS -o $1.o $1.s > /dev/null 2>&1

	if [ "$ARCH" = "arm" ]; then
		if [ $width -eq 2 ]; then
			OBJDUMPFLAGS="-M force-thumb"
		fi

		${CROSS_COMPILE}strip $1.o
	fi

	${CROSS_COMPILE}objdump $OBJDUMPFLAGS -S $1.o | \
		grep -v "/tmp\|Disassembly\|\.text\|^$" > $1.dis 2>&1
}

marker=`expr index "$code" "\<"`
if [ $marker -eq 0 ]; then
	marker=`expr index "$code" "\("`
fi

touch $T.oo
if [ $marker -ne 0 ]; then
	echo All code >> $T.oo
	echo ======== >> $T.oo
	beforemark=`echo "$code"`
	echo -n "	.$type 0x" > $T.s
	echo $beforemark | sed -e 's/ /,0x/g; s/[<>()]//g' >> $T.s
	disas $T
	cat $T.dis >> $T.oo
	rm -f $T.o $T.s $T.dis

# and fix code at-and-after marker
	code=`echo "$code" | cut -c$((${marker} + 1))-`
fi
echo Code starting with the faulting instruction  > $T.aa
echo =========================================== >> $T.aa
code=`echo $code | sed -e 's/ [<(]/ /;s/[>)] / /;s/ /,0x/g; s/[>)]$//'`
echo -n "	.$type 0x" > $T.s
echo $code >> $T.s
disas $T
cat $T.dis >> $T.aa

# (lines of whole $T.oo) - (lines of $T.aa, i.e. "Code starting") + 3,
# i.e. the title + the "===..=" line (sed is counting from 1, 0 address is
# special)
faultlinenum=$(( $(wc -l $T.oo  | cut -d" " -f1) - \
		 $(wc -l $T.aa  | cut -d" " -f1) + 3))

faultline=`cat $T.dis | head -1 | cut -d":" -f2-`
faultline=`echo "$faultline" | sed -e 's/\[/\\\[/g; s/\]/\\\]/g'`

cat $T.oo | sed -e "${faultlinenum}s/^\(.*:\)\(.*\)/\1\*\2\t\t<-- trapping instruction/"
echo
cat $T.aa
cleanup
back to top