sunrpc: Fix latency trace point crashes

If the rpc_task survived longer than the transport, task->tk_xprt
points to freed memory by the time rpc_count_iostats_metrics runs.
Replace the references to task->tk_xprt with references to the
task's tk_client.

Reported-by: syzbot+27db1f90e2b972a5f2d3@syzkaller.appspotmail.com
Fixes: 40bf7eb304b5 ('sunrpc: Add static trace point to report ...')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 76887d60f0c0f7adff0a75054514c240a5403b62..7f1204a179b9f1e2ec3b5900a29ac3a65ef1a8a7 100644 (file)
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -224,6 +224,8 @@ TRACE_EVENT(rpc_stats_latency,
        TP_ARGS(task, backlog, rtt, execute),
 
        TP_STRUCT__entry(
+               __field(unsigned int, task_id)
+               __field(unsigned int, client_id)
                __field(u32, xid)
                __field(int, version)
                __string(progname, task->tk_client->cl_program->name)
@@ -231,13 +233,11 @@ TRACE_EVENT(rpc_stats_latency,
                __field(unsigned long, backlog)
                __field(unsigned long, rtt)
                __field(unsigned long, execute)
-               __string(addr,
-                        task->tk_xprt->address_strings[RPC_DISPLAY_ADDR])
-               __string(port,
-                        task->tk_xprt->address_strings[RPC_DISPLAY_PORT])
        ),
 
        TP_fast_assign(
+               __entry->client_id = task->tk_client->cl_clid;
+               __entry->task_id = task->tk_pid;
                __entry->xid = be32_to_cpu(task->tk_rqstp->rq_xid);
                __entry->version = task->tk_client->cl_vers;
                __assign_str(progname, task->tk_client->cl_program->name)
@@ -245,14 +245,10 @@ TRACE_EVENT(rpc_stats_latency,
                __entry->backlog = ktime_to_us(backlog);
                __entry->rtt = ktime_to_us(rtt);
                __entry->execute = ktime_to_us(execute);
-               __assign_str(addr,
-                            task->tk_xprt->address_strings[RPC_DISPLAY_ADDR]);
-               __assign_str(port,
-                            task->tk_xprt->address_strings[RPC_DISPLAY_PORT]);
        ),
 
-       TP_printk("peer=[%s]:%s xid=0x%08x %sv%d %s backlog=%lu rtt=%lu execute=%lu",
-               __get_str(addr), __get_str(port), __entry->xid,
+       TP_printk("task:%u@%d xid=0x%08x %sv%d %s backlog=%lu rtt=%lu execute=%lu",
+               __entry->task_id, __entry->client_id, __entry->xid,
                __get_str(progname), __entry->version, __get_str(procname),
                __entry->backlog, __entry->rtt, __entry->execute)
 );