Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-26 04:42:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
856ec7f646
linux/drivers/infiniband/core
History
Leon Romanovsky f0abc761bb RDMA/core: Fix race between destroy and release FD object 
The call to ->lookup_put() was too early and it caused an unlock of the
read/write protection of the uobject after the FD was put. This allows a
race:

     CPU1                                 CPU2
 rdma_lookup_put_uobject()
   lookup_put_fd_uobject()
     fput()
				   fput()
				     uverbs_uobject_fd_release()
				       WARN_ON(uverbs_try_lock_object(uobj,
					       UVERBS_LOOKUP_WRITE));
   atomic_dec(usecnt)

Fix the code by changing the order, first unlock and call to
->lookup_put() after that.

Fixes: 3832125624 ("IB/core: Add support for idr types")
Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@kernel.org
Suggested-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-04-24 15:40:41 -03:00
..
addr.c RDMA/netlink: Do not always generate an ACK for some netlink operations 2020-01-03 16:02:32 -04:00
agent.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
agent.h
cache.c RDMA: Replace zero-length array with flexible-array member 2020-02-20 13:33:51 -04:00
cgroup.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
cm_msgs.h RDMA/cm: Remove CM message structs 2020-01-25 15:11:37 -04:00
cm.c RDMA/cm: Fix an error check in cm_alloc_id_priv() 2020-04-14 16:01:38 -03:00
cma_configfs.c RDMA/cma: Rename cma_device ref/deref helpers to to get/put 2020-02-11 13:55:13 -04:00
cma_priv.h RDMA/cma: Use refcount API to reflect refcount 2020-02-11 14:00:40 -04:00
cma_trace.c RDMA/cma: Add trace points in RDMA Connection Manager 2020-01-07 16:10:53 -04:00
cma_trace.h RDMA/cma: Add trace points in RDMA Connection Manager 2020-01-07 16:10:53 -04:00
cma.c RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow 2020-03-26 14:43:12 -03:00
core_priv.h RDMA/core: Fix protection fault in ib_mr_pool_destroy 2020-03-04 13:43:02 -04:00
counters.c RDMA/counter: Prevent auto-binding a QP which are not tracked with res 2019-12-12 15:38:15 -05:00
cq.c RDMA/core: Trace points for diagnosing completion queue issues 2020-01-07 16:10:53 -04:00
device.c RDMA/core: Fix missing error check on dev_set_name() 2020-03-13 10:30:11 -03:00
fmr_pool.c RDMA: Delete DEBUG code 2019-08-20 13:27:53 -04:00
ib_core_uverbs.c RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence 2020-01-25 14:48:33 -04:00
iwcm.c RDMA/iwcm: Fix iwcm work deallocation 2020-03-04 14:28:25 -04:00
iwcm.h
iwpm_msg.c RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb" 2019-08-27 13:09:23 -03:00
iwpm_util.c RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb" 2019-08-27 13:09:23 -03:00
iwpm_util.h infiniband: fix core/ipwm_util.h kernel-doc warnings 2019-10-22 14:45:31 -03:00
mad_priv.h RDMA: Replace zero-length array with flexible-array member 2020-02-20 13:33:51 -04:00
mad_rmpp.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
mad_rmpp.h
mad.c RDMA: Change MAD processing function to remove extra casting and parameter 2019-11-12 20:20:15 -04:00
Makefile RDMA/core: Make ib_uverbs_async_event_file into a uobject 2020-01-13 16:20:16 -04:00
mr_pool.c Linux 5.2-rc6 2019-06-28 21:18:23 -03:00
multicast.c RDMA: Replace zero-length array with flexible-array member 2020-02-20 13:33:51 -04:00
netlink.c IB/core: Avoid deadlock during netlink message handling 2019-10-24 20:49:37 -03:00
nldev.c RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET 2020-03-13 10:23:38 -03:00
opa_smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
packer.c
rdma_core.c RDMA/core: Fix race between destroy and release FD object 2020-04-24 15:40:41 -03:00
rdma_core.h RDMA/core: Make ib_uverbs_async_event_file into a uobject 2020-01-13 16:20:16 -04:00
restrack.c RDMA/restrack: Remove PID namespace support 2019-10-23 15:58:31 -03:00
restrack.h RDMA/restrack: Remove PID namespace support 2019-10-23 15:58:31 -03:00
roce_gid_mgmt.c drivers: use in_dev_for_each_ifa_rtnl/rcu 2019-06-02 18:06:26 -07:00
rw.c RDMA/rw: map P2P memory correctly for signature operations 2020-03-10 12:56:17 -03:00
sa_query.c RDMA: Replace zero-length array with flexible-array member 2020-02-20 13:33:51 -04:00
sa.h RDMA/core: Annotate timeout as unsigned long 2018-10-16 13:34:01 -04:00
security.c RDMA/core: Ensure security pkey modify is not lost 2020-03-24 19:53:25 -03:00
smi.c
smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
sysfs.c RDMA: Change MAD processing function to remove extra casting and parameter 2019-11-12 20:20:15 -04:00
trace.c RDMA/core: Trace points for diagnosing completion queue issues 2020-01-07 16:10:53 -04:00
ucma.c RDMA/ucma: Put a lock around every call to the rdma_cm layer 2020-02-27 16:40:40 -04:00
ud_header.c
umem_odp.c RDMA/odp: Fix leaking the tgid for implicit ODP 2020-03-10 14:29:07 -03:00
umem.c RDMA/core: Add weak ordering dma attr to dma mapping 2020-02-13 13:38:02 -04:00
user_mad.c RDMA/mad: Do not crash if the rdma device does not have a umad interface 2020-03-13 10:32:02 -03:00
uverbs_cmd.c RDMA/core: Fix protection fault in ib_mr_pool_destroy 2020-03-04 13:43:02 -04:00
uverbs_ioctl.c RDMA/core: Do not allow alloc_commit to fail 2020-01-13 16:20:15 -04:00
uverbs_main.c RDMA/uverbs: Fix a race with disassociate and exit_mmap() 2020-04-22 15:43:46 -03:00
uverbs_marshall.c IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *' 2018-06-25 14:19:57 -06:00
uverbs_std_types_async_fd.c RDMA/uverbs: Add ioctl command to get a device context 2020-01-16 15:55:45 -04:00
uverbs_std_types_counters.c IB: When attrs.udata/ufile is available use that instead of uobject 2019-04-08 13:05:25 -03:00
uverbs_std_types_cq.c RDMA/core: Use READ_ONCE for ib_ufile.async_file 2020-01-13 16:20:16 -04:00
uverbs_std_types_device.c RDMA/core: Add the core support field to METHOD_GET_CONTEXT 2020-01-16 15:55:46 -04:00
uverbs_std_types_dm.c IB: When attrs.udata/ufile is available use that instead of uobject 2019-04-08 13:05:25 -03:00
uverbs_std_types_flow_action.c IB: When attrs.udata/ufile is available use that instead of uobject 2019-04-08 13:05:25 -03:00
uverbs_std_types_mr.c Linux 5.2-rc6 2019-06-28 21:18:23 -03:00
uverbs_std_types.c RDMA/core: Add missing list deletion on freeing event queue 2020-02-13 09:44:49 -04:00
uverbs_uapi.c RDMA/core: Make ib_uverbs_async_event_file into a uobject 2020-01-13 16:20:16 -04:00
uverbs.h RDMA/core: Make the entire API tree static 2020-01-30 16:28:52 -04:00
verbs.c RDMA/core: Remove the duplicate header file 2020-03-10 14:34:54 -03:00