From: Gerd Rausch rds_rdma_free_op() and rds_atomic_free_op() are reached from the IB send completion path via rds_ib_tasklet_fn_send() rds_ib_send_cqe_handler() rds_message_put() rds_message_purge() rds_rdma_free_op() / rds_atomic_free_op() which runs in tasklet (softirq) context. Both functions unpin the user pages of the op with unpin_user_pages_dirty_lock(), which uses set_page_dirty_lock() and thus may call lock_page() and sleep. Sleeping in softirq context is not allowed and can deadlock or crash. Dirty the pages with set_page_dirty() and release them with unpin_user_page() instead, the same way this code handled the pages before the conversion to the pin_user_pages API. This mirrors Oracle UEK commit "net/rds: Avoid unpin_user_pages_dirty_lock() in tasklets". Fixes: 0d4597c8c5ab ("net/rds: Track user mapped pages through special API") Signed-off-by: Gerd Rausch [achender: port to net-next; omit UEK's WARN_ON_ONCE(!page->mapping && irqs_disabled()) debug check; update commit message] Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson --- net/rds/rdma.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/rds/rdma.c b/net/rds/rdma.c index 61fb6e45281bf..201cbe38fa893 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c @@ -495,9 +495,13 @@ void rds_rdma_free_op(struct rm_rdma_op *ro) /* Mark page dirty if it was possibly modified, which * is the case for a RDMA_READ which copies from remote - * to local memory + * to local memory. This can be called from the IB + * send completion tasklet, so the sleeping _lock + * variant must not be used here. */ - unpin_user_pages_dirty_lock(&page, 1, !ro->op_write); + if (!ro->op_write) + set_page_dirty(page); + unpin_user_page(page); } } @@ -513,8 +517,12 @@ void rds_atomic_free_op(struct rm_atomic_op *ao) /* Mark page dirty if it was possibly modified, which * is the case for a RDMA_READ which copies from remote - * to local memory */ - unpin_user_pages_dirty_lock(&page, 1, true); + * to local memory. This can be called from the IB send + * completion tasklet, so the sleeping _lock variant must + * not be used here. + */ + set_page_dirty(page); + unpin_user_page(page); kfree(ao->op_notifier); ao->op_notifier = NULL; -- 2.25.1