leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4d6e4d12da
linux/drivers/infiniband/core
History
Leon Romanovsky fe9bc16449 RDMA/restrack: Protect from reentry to resource return path 
Nullify the resource task struct pointer to ensure that subsequent calls
won't try to release task_struct again.

------------[ cut here ]------------
ODEBUG: free active (active state 1) object type: rcu_head hint:
(null)
WARNING: CPU: 0 PID: 6048 at lib/debugobjects.c:329
debug_print_object+0x16a/0x210 lib/debugobjects.c:326
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 6048 Comm: syz-executor022 Not tainted
4.19.0-rc7-next-20181008+ #89
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x244/0x3ab lib/dump_stack.c:113
  panic+0x238/0x4e7 kernel/panic.c:184
  __warn.cold.8+0x163/0x1ba kernel/panic.c:536
  report_bug+0x254/0x2d0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:178 [inline]
  do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
  do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290
  invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969
RIP: 0010:debug_print_object+0x16a/0x210 lib/debugobjects.c:326
Code: 41 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 92 00 00 00 48 8b 14
dd
60 02 41 88 4c 89 fe 48 c7 c7 00 f8 40 88 e8 36 2f b4 fd <0f> 0b 83 05
a9
f4 5e 06 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffff8801d8c3eda8 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8164d235 RDI: 0000000000000005
RBP: ffff8801d8c3ede8 R08: ffff8801d70aa280 R09: ffffed003b5c3eda
R10: ffffed003b5c3eda R11: ffff8801dae1f6d7 R12: 0000000000000001
R13: ffffffff8939a760 R14: 0000000000000000 R15: ffffffff8840fca0
  __debug_check_no_obj_freed lib/debugobjects.c:786 [inline]
  debug_check_no_obj_freed+0x3ae/0x58d lib/debugobjects.c:818
  kmem_cache_free+0x202/0x290 mm/slab.c:3759
  free_task_struct kernel/fork.c:163 [inline]
  free_task+0x16e/0x1f0 kernel/fork.c:457
  __put_task_struct+0x2e6/0x620 kernel/fork.c:730
  put_task_struct include/linux/sched/task.h:96 [inline]
  finish_task_switch+0x66c/0x900 kernel/sched/core.c:2715
  context_switch kernel/sched/core.c:2834 [inline]
  __schedule+0x8d7/0x21d0 kernel/sched/core.c:3480
  schedule+0xfe/0x460 kernel/sched/core.c:3524
  freezable_schedule include/linux/freezer.h:172 [inline]
  futex_wait_queue_me+0x3f9/0x840 kernel/futex.c:2530
  futex_wait+0x45c/0xa50 kernel/futex.c:2645
  do_futex+0x31a/0x26d0 kernel/futex.c:3528
  __do_sys_futex kernel/futex.c:3589 [inline]
  __se_sys_futex kernel/futex.c:3557 [inline]
  __x64_sys_futex+0x472/0x6a0 kernel/futex.c:3557
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446549
Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f3a998f5da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446549
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc38
RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 2f646e6162696e69 R14: 666e692f7665642f R15: 00000000006dbd2c
Kernel Offset: disabled

Reported-by: syzbot+71aff6ea121ffefc280f@syzkaller.appspotmail.com
Fixes: ed7a01fd3f ("RDMA/restrack: Release task struct which was hold by CM_ID object")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-10-16 08:24:36 -06:00
..
addr.c RDMA/core: Check error status of rdma_find_ndev_for_src_ip_rcu 2018-10-03 20:47:41 -06:00
agent.c IB/core: Rename ib_destroy_ah to rdma_destroy_ah 2017-05-01 14:32:43 -04:00
agent.h
cache.c Merge branch 'for-rc' into rdma.git for-next 2018-10-16 00:01:02 -06:00
cgroup.c IB/core: added support to use rdma cgroup controller 2017-01-10 11:14:27 -05:00
cm_msgs.h IB/cm: Remove unused and erroneous msg sequence encoding 2018-07-09 11:39:28 -06:00
cm.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
cma_configfs.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
cma_priv.h RDMA/cma: Move rdma_cm_state to cma_priv.h 2018-03-29 13:54:21 -06:00
cma.c Merge branch 'for-rc' into rdma.git for-next 2018-10-16 00:01:02 -06:00
core_priv.h RDMA/core: Consider net ns of gid attribute for RoCE 2018-09-12 16:32:17 -06:00
cq.c RDMA/restrack: Consolidate task name updates in one place 2018-10-05 16:07:39 -06:00
device.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
fmr_pool.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
iwcm.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
iwcm.h
iwpm_msg.c RDMA/iwpm: Properly mark end of NL messages 2017-09-29 11:32:42 -04:00
iwpm_util.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
iwpm_util.h
mad_priv.h IB/mad: Use IDR for agent IDs 2018-06-18 11:22:54 -06:00
mad_rmpp.c IB/mad: Change slid in RMPP recv from 16 to 32 bits 2017-08-08 14:47:18 -04:00
mad_rmpp.h
mad.c RDMA/core: Rate limit MAD error messages 2018-09-06 13:35:16 -06:00
Makefile IB/uverbs: Remove struct uverbs_root_spec and all supporting code 2018-08-13 09:17:19 -06:00
mr_pool.c
multicast.c IB: Make ib_init_ah_from_mcmember set sgid_attr 2018-06-25 14:19:56 -06:00
netlink.c RDMA/netlink: Simplify netlink listener existence check 2018-10-03 16:06:07 -06:00
nldev.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
opa_smi.h
packer.c
rdma_core.c RDMA/uverbs: Get rid of ucontext->tgid 2018-09-21 11:58:36 -04:00
rdma_core.h RDMA/ucontext: Add a core API for mmaping driver IO memory 2018-09-20 16:19:30 -04:00
restrack.c RDMA/restrack: Protect from reentry to resource return path 2018-10-16 08:24:36 -06:00
roce_gid_mgmt.c IB/core: Change filter function return type from int to bool 2018-08-15 13:33:20 -06:00
rw.c RDMA/core: Simplify ib_post_(send|recv|srq_recv)() calls 2018-07-24 16:06:36 -06:00
sa_query.c RDMA/netlink: Simplify netlink listener existence check 2018-10-03 16:06:07 -06:00
sa.h
security.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
smi.c
smi.h
sysfs.c RDMA: Fully setup the device name in ib_register_device 2018-09-26 13:51:36 -06:00
ucm.c IB/ucm: Fix compiling ucm.c 2018-08-13 20:04:37 -06:00
ucma.c ucma: fix a use-after-free in ucma_resolve_ip() 2018-09-13 13:04:13 -04:00
ud_header.c
umem_odp.c RDMA/umem: Avoid synchronize_srcu in the ODP MR destruction path 2018-09-21 11:58:36 -04:00
umem.c RDMA/core: Acquire and release mmap_sem on page range 2018-09-27 12:40:20 -06:00
user_mad.c RDMA/core: Use dev_name instead of ibdev->name 2018-09-26 13:51:48 -06:00
uverbs_cmd.c Merge branch 'for-rc' into rdma.git for-next 2018-10-16 00:01:02 -06:00
uverbs_ioctl.c RDMA/uverbs: Fix RCU annotation for radix slot deference 2018-10-03 16:01:40 -06:00
uverbs_main.c Merge branch 'for-rc' into rdma.git for-next 2018-10-16 00:01:02 -06:00
uverbs_marshall.c IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *' 2018-06-25 14:19:57 -06:00
uverbs_std_types_counters.c IB/uverbs: Use uverbs_alloc for allocations 2018-08-13 09:16:13 -06:00
uverbs_std_types_cq.c IB/uverbs: Do not pass struct ib_device to the ioctl methods 2018-08-01 14:55:48 -06:00
uverbs_std_types_dm.c IB/uverbs: Do not pass struct ib_device to the ioctl methods 2018-08-01 14:55:48 -06:00
uverbs_std_types_flow_action.c RDMA/uverbs: Add generic function to fill in flow action object 2018-09-05 15:23:59 -06:00
uverbs_std_types_mr.c IB/uverbs: Do not pass struct ib_device to the ioctl methods 2018-08-01 14:55:48 -06:00
uverbs_std_types.c IB/uverbs: Remove the ib_uverbs_attr pointer from each attr 2018-08-10 16:06:24 -06:00
uverbs_uapi.c Merge branch 'for-rc' into rdma.git for-next 2018-10-16 00:01:02 -06:00
uverbs.h RDMA/ucontext: Add a core API for mmaping driver IO memory 2018-09-20 16:19:30 -04:00
verbs.c RDMA/restrack: Consolidate task name updates in one place 2018-10-05 16:07:39 -06:00