Linux RDMA and InfiniBand development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Chuck Lever" <cel@kernel.org>
Cc: linux-rdma@vger.kernel.org, "Jeff Layton" <jlayton@kernel.org>,
	"Anna Schumaker" <anna@kernel.org>
Subject: Re: [PATCH 3/5] svcrdma: Hold a module reference for the backchannel transport
Date: Wed, 04 Nov 2026 18:04:44 +0000	[thread overview]
Message-ID: <sashiko-outbox-197813@kernel.org> (raw)
In-Reply-To: <20261104-liange-v1-3-f097e10cea1b@kernel.org>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] svcrdma: inaccurate Fixes tag in commit message
--

commit 5aa6827a1ec45b94a0a4813a38c3cc653c0334bf
Author: Chuck Lever <cel@kernel.org>

svcrdma: Hold a module reference for the backchannel transport

This commit takes a module reference in xprt_setup_rdma_bc() and releases
it in xprt_rdma_bc_put() so that the rpcrdma module stays pinned while the
backchannel rpc_xprt exists and its deferred destruction work item runs.

>     svcrdma: Hold a module reference for the backchannel transport
>     
>     The last put on an RDMA backchannel rpc_xprt runs xprt_destroy(),
>     which queues xprt_destroy_cb() on a workqueue. That work item calls
>     xprt_rdma_bc_put() through xprt->ops. Nothing pins the rpcrdma
>     module while the rpc_xprt exists: xprt_create_transport() drops the
>     class reference as soon as ->setup() returns, and svc_xprt_free()
>     releases its own module reference right after the final put. An
>     rmmod of rpcrdma can therefore race the pending work item and run
>     freed module text. The TCP backchannel in xs_setup_bc_tcp() and the
>     forward transport in xprt_setup_rdma() both hold a module reference
>     for the life of the rpc_xprt.
>     
>     Take a module reference in xprt_setup_rdma_bc() and release it in
>     xprt_rdma_bc_put(), as xprt_setup_rdma() and xprt_rdma_destroy() do.
>     
>     Fixes: 5d252f90a800 ("svcrdma: Add class for RDMA backwards direction transport")
>     Cc: stable@vger.kernel.org
>     Signed-off-by: Chuck Lever <cel@kernel.org>

[Severity: Low]
In net/sunrpc/xprtrdma/svc_rdma_backchannel.c, commit 5d252f90a800
("svcrdma: Add class for RDMA backwards direction transport") originally
included both try_module_get(THIS_MODULE) in xprt_setup_rdma_bc() and
module_put(THIS_MODULE) in xprt_rdma_bc_put().

Those calls were later removed by commit 07880fa4968b ("svcrdma: Remove
try_module_get from backchannel") when svcrdma and xprtrdma were merged
into a single module.

Should the Fixes tag reference commit 07880fa4968b instead so stable
backporting targets the commit that removed the module reference?

  Fixes: 07880fa4968b ("svcrdma: Remove try_module_get from backchannel")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104-liange-v1-0-f097e10cea1b@kernel.org?part=3

  reply	other threads:[~2026-11-04 18:04 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-04 17:49 [PATCH 0/5] SUNRPC: Fix backchannel transport lifetime bugs Chuck Lever
2026-11-04 17:49 ` [PATCH 1/5] SUNRPC: Reject add_xprt on a backchannel xprt_switch Chuck Lever
2026-11-04 17:59   ` sashiko-bot
2026-11-04 17:49 ` [PATCH 2/5] svcrdma: drop the extra reference on the backchannel transport Chuck Lever
2026-11-04 18:03   ` sashiko-bot
2026-11-04 17:49 ` [PATCH 3/5] svcrdma: Hold a module reference for " Chuck Lever
2026-11-04 18:04   ` sashiko-bot [this message]
2026-11-04 17:49 ` [PATCH 4/5] svcrdma: Set xprt_class on " Chuck Lever
2026-11-04 17:53   ` sashiko-bot
2026-11-04 17:49 ` [PATCH 5/5] SUNRPC: Set up the servername before the transport is created Chuck Lever
2026-11-04 17:54   ` sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-197813@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=anna@kernel.org \
    --cc=cel@kernel.org \
    --cc=jlayton@kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox