Files
linux-stable-mirror/include/linux
Chuck LeverandGreg Kroah-Hartman c7a0b17368 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
[ Upstream commit 765bde47fe ]

xprt_rdma_alloc_slot() and xprt_rdma_free_slot() lack serialization
between the buffer pool and the backlog queue.  A buffer freed
after rpcrdma_buffer_get() finds the pool empty but before
rpc_sleep_on() places the task on the backlog is returned to the
pool with no waiter to wake, leaving the task stuck on the backlog
indefinitely.

After joining the backlog, re-check the pool and route any
recovered buffer through xprt_wake_up_backlog(), whose queue lock
serializes with concurrent wakeups and avoids double-assignment
of slots.

Because xprt_rdma_free_slot() does not hold reserve_lock, the
XPRT_CONGESTED double-check in xprt_throttle_congested() is
ineffective: a task can join the backlog through that path after
free_slot has already found it empty and cleared the bit.  Avoid
this by using xprt_add_backlog_noncongested(), which queues the
task without setting XPRT_CONGESTED, so every allocation reaches
xprt_rdma_alloc_slot() and its post-sleep re-check.

Fixes: edb41e61a5 ("xprtrdma: Make rpc_rqst part of rpcrdma_req")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: e786233d2e ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-07-24 15:54:46 +02:00
..
2026-03-04 07:19:30 -05:00
2026-03-25 11:03:01 +01:00
2025-09-11 17:19:15 +02:00
2026-07-24 15:54:27 +02:00
2024-12-14 19:54:37 +01:00
2026-07-24 15:54:17 +02:00
2026-01-11 15:19:01 +01:00
2025-07-06 10:58:04 +02:00
2026-01-11 15:18:35 +01:00
2025-06-04 14:40:25 +02:00
2026-06-01 17:39:24 +02:00
2025-08-15 12:04:54 +02:00
2026-06-19 13:37:20 +02:00
2026-01-11 15:18:48 +01:00
2025-02-01 18:30:05 +01:00
2026-01-11 15:19:13 +01:00