* [PATCH 2/2] ib/cm: Bump reference count on cm_id before invoking callback
@ 2011-02-23 16:17 Hefty, Sean
[not found] ` <CF9C39F99A89134C9CF9C4CCB68B8DDF25CC6C5393-osO9UTpF0USkrb+BlOpmy7fspsVTdybXVpNB7YpNyf8@public.gmane.org>
0 siblings, 1 reply; 2+ messages in thread
From: Hefty, Sean @ 2011-02-23 16:17 UTC (permalink / raw)
To: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Roland Dreier; +Cc: Doug Ledford
When processing a SIDR REQ, the ib_cm allocates a new cm_id. The refcount
of the cm_id is initialized to 1. However, cm_process_work will
decrement the refcount after invoking all callbacks. The result is that
the cm_id will end up with refcount set to 0 by the end of the sidr req
handler.
If a user tries to destroy the cm_id, the destruction will proceed, under
the incorrect assumption that no other threads are referencing the cm_id.
This can lead to a crash when the cm callback thread tries to access
the cm_id.
This problem was noticed as part of a larger investigation with kernel
crashes in the rdma_cm when running on a real time OS.
Signed-off-by: Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
---
drivers/infiniband/core/cm.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 64e0903..1d9616b 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -2989,6 +2989,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
goto out; /* No match. */
}
atomic_inc(&cur_cm_id_priv->refcount);
+ atomic_inc(&cm_id_priv->refcount);
spin_unlock_irq(&cm.lock);
cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 2/2] ib/cm: Bump reference count on cm_id before invoking callback
[not found] ` <CF9C39F99A89134C9CF9C4CCB68B8DDF25CC6C5393-osO9UTpF0USkrb+BlOpmy7fspsVTdybXVpNB7YpNyf8@public.gmane.org>
@ 2011-02-23 17:57 ` Doug Ledford
0 siblings, 0 replies; 2+ messages in thread
From: Doug Ledford @ 2011-02-23 17:57 UTC (permalink / raw)
To: Hefty, Sean; +Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, Roland Dreier
[-- Attachment #1: Type: text/plain, Size: 1775 bytes --]
On Wed, 2011-02-23 at 08:17 -0800, Hefty, Sean wrote:
> When processing a SIDR REQ, the ib_cm allocates a new cm_id. The refcount
> of the cm_id is initialized to 1. However, cm_process_work will
> decrement the refcount after invoking all callbacks. The result is that
> the cm_id will end up with refcount set to 0 by the end of the sidr req
> handler.
>
> If a user tries to destroy the cm_id, the destruction will proceed, under
> the incorrect assumption that no other threads are referencing the cm_id.
> This can lead to a crash when the cm callback thread tries to access
> the cm_id.
>
> This problem was noticed as part of a larger investigation with kernel
> crashes in the rdma_cm when running on a real time OS.
>
> Signed-off-by: Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
Acked-by: Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>
> drivers/infiniband/core/cm.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
> index 64e0903..1d9616b 100644
> --- a/drivers/infiniband/core/cm.c
> +++ b/drivers/infiniband/core/cm.c
> @@ -2989,6 +2989,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
> goto out; /* No match. */
> }
> atomic_inc(&cur_cm_id_priv->refcount);
> + atomic_inc(&cm_id_priv->refcount);
> spin_unlock_irq(&cm.lock);
>
> cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
>
>
--
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
GPG KeyID: CFBFF194
http://people.redhat.com/dledford
Infiniband specific RPMs available at
http://people.redhat.com/dledford/Infiniband
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-02-23 17:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-23 16:17 [PATCH 2/2] ib/cm: Bump reference count on cm_id before invoking callback Hefty, Sean
[not found] ` <CF9C39F99A89134C9CF9C4CCB68B8DDF25CC6C5393-osO9UTpF0USkrb+BlOpmy7fspsVTdybXVpNB7YpNyf8@public.gmane.org>
2011-02-23 17:57 ` Doug Ledford
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.