• Chuck Lever's avatar
    SUNRPC: Remove trace_xprt_transmit_queued · 6cf23783
    Chuck Lever authored
    This tracepoint can crash when dereferencing snd_task because
    when some transports connect, they put a cookie in that field
    instead of a pointer to an rpc_task.
    
    BUG: KASAN: use-after-free in trace_event_raw_event_xprt_writelock_event+0x141/0x18e [sunrpc]
    Read of size 2 at addr ffff8881a83bd3a0 by task git/331872
    
    CPU: 11 PID: 331872 Comm: git Tainted: G S                5.12.0-rc2-00007-g3ab6e585a7f9 #1453
    Hardware name: Supermicro SYS-6028R-T/X10DRi, BIOS 1.1a 10/16/2015
    Call Trace:
     dump_stack+0x9c/0xcf
     print_address_description.constprop.0+0x18/0x239
     kasan_report+0x174/0x1b0
     trace_event_raw_event_xprt_writelock_event+0x141/0x18e [sunrpc]
     xprt_prepare_transmit+0x8e/0xc1 [sunrpc]
     call_transmit+0x4d/0xc6 [sunrpc]
    
    Fixes: 9ce07ae5 ("SUNRPC: Replace dprintk() call site in xprt_prepare_transmit")
    Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
    Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
    6cf23783
xprt.c 52.1 KB