[PATCH v1 3/5] svcrdma: fix a page leak in backchannel sends

[Chuck Lever <cel@kernel.org>]

svc_rdma_bc_sendto() takes an extra reference on the page that
holds the backchannel Call message, so that the page is not
returned to the allocator while the Send that reads it is still
posted. Send completion once dropped that reference, back when the
page sat in the send context's page array. Commit 99722fe4d5a6
("svcrdma: Persistently allocate and DMA-map Send buffers")
switched the backchannel to svc_rdma_map_reply_msg(), which
DMA-maps the buffer and records no pages. Send completion no
longer touches the page, but the get_page() stayed.

xprt_rdma_bc_free() drops the allocation reference and nothing
drops the extra one, so every backchannel Call sent over RPC/RDMA
leaks its send buffer page.

The extra reference is still needed. A Call at or above
RPCRDMA_PULLUP_THRESH is DMA-mapped in place. The RPC client frees
rq_buffer when the callback task times out or is killed, whether
or not the Send has completed. Record the page in the send
context's page array so that svc_rdma_send_ctxt_release() drops
the reference after Send completion.

Fixes: 99722fe4d5a6 ("svcrdma: Persistently allocate and DMA-map Send buffers")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index e5a78b761012..e0768d1ee556 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -85,10 +85,14 @@ static int svc_rdma_bc_sendto(struct svcxprt_rdma *rdma,
 	if (ret < 0)
 		return -EIO;
 
-	/* Bump page refcnt so Send completion doesn't release
-	 * the rq_buffer before all retransmits are complete.
+	/* The RPC client frees rq_buffer when the callback task ends,
+	 * whether or not the Send has completed. Hold the page until the
+	 * send context is released after Send completion.
 	 */
-	get_page(virt_to_page(rqst->rq_buffer));
+	sctxt->sc_pages[0] = virt_to_page(rqst->rq_buffer);
+	get_page(sctxt->sc_pages[0]);
+	sctxt->sc_page_count = 1;
+
 	sctxt->sc_send_wr.opcode = IB_WR_SEND;
 	return svc_rdma_post_send(rdma, sctxt);
 }
-- 
2.55.0