All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tao Liu <thomas.liu@ucloud.cn>
To: dledford@redhat.com, jgg@ziepe.ca, leon@kernel.org,
	haakon.bugge@oracle.com, shayd@nvidia.com, avihaih@nvidia.com
Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
	thomas.liu@ucloud.com
Subject: [PATCH] RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
Date: Mon, 13 Sep 2021 17:33:44 +0800	[thread overview]
Message-ID: <20210913093344.17230-1-thomas.liu@ucloud.cn> (raw)

rdma_cma_listen_on_all() just destroy listener which lead to an error,
but not including those already added in listen_list. Then cm state
fallbacks to RDMA_CM_ADDR_BOUND.

When user destroys id, the listeners will not be destroyed, and
process stucks.

 task:rping state:D stack:   0 pid:19605 ppid: 47036 flags:0x00000084
 Call Trace:
  __schedule+0x29a/0x780
  ? free_unref_page_commit+0x9b/0x110
  schedule+0x3c/0xa0
  schedule_timeout+0x215/0x2b0
  ? __flush_work+0x19e/0x1e0
  wait_for_completion+0x8d/0xf0
  _destroy_id+0x144/0x210 [rdma_cm]
  ucma_close_id+0x2b/0x40 [rdma_ucm]
  __destroy_id+0x93/0x2c0 [rdma_ucm]
  ? __xa_erase+0x4a/0xa0
  ucma_destroy_id+0x9a/0x120 [rdma_ucm]
  ucma_write+0xb8/0x130 [rdma_ucm]
  vfs_write+0xb4/0x250
  ksys_write+0xb5/0xd0
  ? syscall_trace_enter.isra.19+0x123/0x190
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: c80a0c52d85c ("RDMA/cma: Add missing error handling of listen_id")
Signed-off-by: Tao Liu <thomas.liu@ucloud.cn>
---
 drivers/infiniband/core/cma.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index c40791b..d8cea33 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1746,16 +1746,11 @@ static void cma_cancel_route(struct rdma_id_private *id_priv)
 	}
 }
 
-static void cma_cancel_listens(struct rdma_id_private *id_priv)
+static void _cma_cancel_listens(struct rdma_id_private *id_priv)
 {
 	struct rdma_id_private *dev_id_priv;
 
-	/*
-	 * Remove from listen_any_list to prevent added devices from spawning
-	 * additional listen requests.
-	 */
-	mutex_lock(&lock);
-	list_del(&id_priv->list);
+	lockdep_assert_held(&lock);
 
 	while (!list_empty(&id_priv->listen_list)) {
 		dev_id_priv = list_entry(id_priv->listen_list.next,
@@ -1768,6 +1763,18 @@ static void cma_cancel_listens(struct rdma_id_private *id_priv)
 		rdma_destroy_id(&dev_id_priv->id);
 		mutex_lock(&lock);
 	}
+}
+
+static void cma_cancel_listens(struct rdma_id_private *id_priv)
+{
+	/*
+	 * Remove from listen_any_list to prevent added devices from spawning
+	 * additional listen requests.
+	 */
+	mutex_lock(&lock);
+	list_del(&id_priv->list);
+
+	_cma_cancel_listens(id_priv);
 	mutex_unlock(&lock);
 }
 
@@ -2575,6 +2582,7 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)
 
 err_listen:
 	list_del(&id_priv->list);
+	_cma_cancel_listens(id_priv);
 	mutex_unlock(&lock);
 	if (to_destroy)
 		rdma_destroy_id(&to_destroy->id);
-- 
1.8.3.1


             reply	other threads:[~2021-09-13  9:41 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-13  9:33 Tao Liu [this message]
2021-09-13 11:16 ` [PATCH] RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure Leon Romanovsky
2021-09-14 19:54 ` Jason Gunthorpe
2021-09-14 23:17   ` Leon Romanovsky
2021-09-16 13:57     ` Jason Gunthorpe
2021-09-15  6:34   ` Mark Zhang
2021-09-15 13:18     ` Jason Gunthorpe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210913093344.17230-1-thomas.liu@ucloud.cn \
    --to=thomas.liu@ucloud.cn \
    --cc=avihaih@nvidia.com \
    --cc=dledford@redhat.com \
    --cc=haakon.bugge@oracle.com \
    --cc=jgg@ziepe.ca \
    --cc=leon@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=shayd@nvidia.com \
    --cc=thomas.liu@ucloud.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.