[Devel] [PATCH RK hci-7.4 1/2] fs/fuse kio: keep pcs_rdma_io.c line numbers stable in the RK

["Denis V. Lunev" <den@openvz.org>]

TRACE() embeds __LINE__, so the net line shift of "fix RPC response
drop for large messages sent over RDMA" changes the trace string of
every TRACE() user below rio_handle_tx(). kpatch-build then treats
pcs_rdma_create() and the RDMA event handlers as changed and puts
copies of them into the patch module.

The patched pcs_rdma_create() stores the addresses of those copies in
rio->id.event_handler, cq->event_handler and qp->event_handler, which
live as long as the connection. Once the RK is replaced and its module
unloaded, the next CM event on such a connection jumps into freed
memory:

  BUG: unable to handle page fault for address: ffffffffc170ef30
  #PF: supervisor instruction fetch in kernel mode
  RIP: 0010:0xffffffffc170ef30
   cma_cm_event_handler+0x1e/0xd0 [rdma_cm]

Reset the line counter with #line after the two changed functions so
everything below them is identical to the base kernel and stays out of
the patch.

https://virtuozzo.atlassian.net/browse/VSTOR-151314
Signed-off-by: Denis V. Lunev <den@openvz.org>
---
 fs/fuse/kio/pcs/pcs_rdma_io.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/kio/pcs/pcs_rdma_io.c b/fs/fuse/kio/pcs/pcs_rdma_io.c
index 63fb1e7..67f3aad 100644
--- a/fs/fuse/kio/pcs/pcs_rdma_io.c
+++ b/fs/fuse/kio/pcs/pcs_rdma_io.c
@@ -830,6 +830,7 @@ static void rio_handle_tx(struct pcs_rdmaio *rio, struct rio_tx *tx, int ok)
 			BUG();
 	}
 }
+#line 836
 
 /*
  * rio wire header is already stripped, buf points to payload data (pcs_rpc hdr)
@@ -937,6 +938,7 @@ static int rio_handle_rx_read_ack(struct pcs_rdmaio *rio,
 
 	return PCS_ERR_NET_ABORT;
 }
+#line 941
 
 /*
  * When we see RX coming from the wire very first time, flag "pended" is
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel