* [PATCH for-next] RDMA/rxe: Fix mr->map double free
@ 2022-10-30 2:38 Li Zhijian
2022-10-30 2:53 ` Li Zhijian
0 siblings, 1 reply; 2+ messages in thread
From: Li Zhijian @ 2022-10-30 2:38 UTC (permalink / raw)
To: zyjzyj2000, jgg, leon, linux-rdma; +Cc: Bob Pearson, linux-kernel, Li Zhijian
rxe_mr_cleanup() which tries to free mr->map again will be called
when rxe_mr_init_user() fails.
[43895.939883] CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25
[43895.942341] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[43895.945208] Call Trace:
[43895.946130] <TASK>
[43895.946931] dump_stack_lvl+0x45/0x5d
[43895.948049] panic+0x19e/0x349
[43895.949010] ? panic_print_sys_info.part.0+0x77/0x77
[43895.950356] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[43895.952589] ? preempt_count_sub+0x14/0xc0
[43895.953809] end_report.part.0+0x54/0x7c
[43895.954993] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
[43895.956406] kasan_report.cold+0xa/0xf
[43895.957668] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
[43895.959090] rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
[43895.960502] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe]
[43895.961983] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe]
[43895.963456] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs]
[43895.964921] ? __lock_acquire+0x876/0x31e0
[43895.966182] ? ib_uverbs_ex_create_wq+0x630/0x630 [ib_uverbs]
[43895.967739] ? uverbs_fill_udata+0x1c6/0x330 [ib_uverbs]
[43895.969204] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs]
[43895.971126] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
[43895.973094] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
[43895.975096] ? uverbs_fill_udata+0x25f/0x330 [ib_uverbs]
[43895.976466] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs]
[43895.977930] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
[43895.979937] ? uverbs_fill_udata+0x330/0x330 [ib_uverbs]
This issue was fistrly exposed since
commit: b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code")
and then we fixed it in
commit: 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()")
but this fix was reverted together at last by
commit: 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
Fixes: 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
---
drivers/infiniband/sw/rxe/rxe_mr.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index d4f10c2d1aa7..baa9d3be178a 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -99,6 +99,7 @@ static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf)
kfree(mr->map[i]);
kfree(mr->map);
+ mr->map = NULL;
err1:
return -ENOMEM;
}
@@ -163,9 +164,8 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
pr_warn("%s: Unable to get virtual address\n",
__func__);
err = -ENOMEM;
- goto err_cleanup_map;
+ goto err_release_umem;
}
-
buf->addr = (uintptr_t)vaddr;
buf->size = PAGE_SIZE;
num_buf++;
@@ -182,10 +182,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
return 0;
-err_cleanup_map:
- for (i = 0; i < mr->num_map; i++)
- kfree(mr->map[i]);
- kfree(mr->map);
err_release_umem:
ib_umem_release(umem);
err_out:
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH for-next] RDMA/rxe: Fix mr->map double free
2022-10-30 2:38 [PATCH for-next] RDMA/rxe: Fix mr->map double free Li Zhijian
@ 2022-10-30 2:53 ` Li Zhijian
0 siblings, 0 replies; 2+ messages in thread
From: Li Zhijian @ 2022-10-30 2:53 UTC (permalink / raw)
To: zyjzyj2000, jgg, leon, linux-rdma; +Cc: Bob Pearson, linux-kernel
Please ignore this one, which failed to compile because it was based on a wrong branch
i will repost a new one later.
On 30/10/2022 10:38, Li Zhijian wrote:
> rxe_mr_cleanup() which tries to free mr->map again will be called
> when rxe_mr_init_user() fails.
>
> [43895.939883] CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25
> [43895.942341] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
> [43895.945208] Call Trace:
> [43895.946130] <TASK>
> [43895.946931] dump_stack_lvl+0x45/0x5d
> [43895.948049] panic+0x19e/0x349
> [43895.949010] ? panic_print_sys_info.part.0+0x77/0x77
> [43895.950356] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
> [43895.952589] ? preempt_count_sub+0x14/0xc0
> [43895.953809] end_report.part.0+0x54/0x7c
> [43895.954993] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.956406] kasan_report.cold+0xa/0xf
> [43895.957668] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.959090] rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.960502] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe]
> [43895.961983] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe]
> [43895.963456] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs]
> [43895.964921] ? __lock_acquire+0x876/0x31e0
> [43895.966182] ? ib_uverbs_ex_create_wq+0x630/0x630 [ib_uverbs]
> [43895.967739] ? uverbs_fill_udata+0x1c6/0x330 [ib_uverbs]
> [43895.969204] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs]
> [43895.971126] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.973094] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.975096] ? uverbs_fill_udata+0x25f/0x330 [ib_uverbs]
> [43895.976466] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs]
> [43895.977930] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.979937] ? uverbs_fill_udata+0x330/0x330 [ib_uverbs]
>
> This issue was fistrly exposed since
> commit: b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code")
> and then we fixed it in
> commit: 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()")
> but this fix was reverted together at last by
> commit: 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
>
> Fixes: 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
> Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
> ---
> drivers/infiniband/sw/rxe/rxe_mr.c | 8 ++------
> 1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
> index d4f10c2d1aa7..baa9d3be178a 100644
> --- a/drivers/infiniband/sw/rxe/rxe_mr.c
> +++ b/drivers/infiniband/sw/rxe/rxe_mr.c
> @@ -99,6 +99,7 @@ static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf)
> kfree(mr->map[i]);
>
> kfree(mr->map);
> + mr->map = NULL;
> err1:
> return -ENOMEM;
> }
> @@ -163,9 +164,8 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
> pr_warn("%s: Unable to get virtual address\n",
> __func__);
> err = -ENOMEM;
> - goto err_cleanup_map;
> + goto err_release_umem;
> }
> -
> buf->addr = (uintptr_t)vaddr;
> buf->size = PAGE_SIZE;
> num_buf++;
> @@ -182,10 +182,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
>
> return 0;
>
> -err_cleanup_map:
> - for (i = 0; i < mr->num_map; i++)
> - kfree(mr->map[i]);
> - kfree(mr->map);
> err_release_umem:
> ib_umem_release(umem);
> err_out:
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-30 2:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-30 2:38 [PATCH for-next] RDMA/rxe: Fix mr->map double free Li Zhijian
2022-10-30 2:53 ` Li Zhijian
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).